SB2026031904 - SUSE update for go1.25

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026031904

SB2026031904 - SUSE update for go1.25

Published: March 19, 2026

Security Bulletin ID SB2026031904
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-25679)

The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.

The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.

This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.


2) Path traversal (CVE-ID: CVE-2026-27139)

The vulnerability allows a local user to access file metadata outside the intended root directory.

The vulnerability exists due to improper handling of symbolic links in os.FileInfo when listing directory contents via File.ReadDir or File.Readdir on Unix platforms. A local user can replace a path component with a symbolic link to cause lstat to access a file outside the root, allowing metadata disclosure.

The impact is limited to reading file metadata such as size and existence; it does not allow reading or modifying file contents. The user must have access to the directory being listed and the ability to create or modify symbolic links within the path.


3) Cross-site scripting (CVE-ID: CVE-2026-27142)

The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser via cross-site scripting (XSS).

The vulnerability exists due to improper output neutralization in html/template when inserting URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute. A remote attacker can craft a URL that is not properly escaped, leading to script execution when the page is rendered.

Exploitation requires user interaction, as the victim must load the malicious page. This vulnerability affects applications using the html/template package to generate such meta tags.


Remediation

Install update from vendor's website.

References