SB2026031905 - SUSE update for go1.26

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-25679)

The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.

The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.

This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.

2) Improper Authorization (CVE-ID: CVE-2026-27137)

The vulnerability allows a remote attacker to bypass email address constraints during X.509 certificate chain verification.

The vulnerability exists due to improper enforcement of email constraints in crypto/x509 when verifying certificate chains containing multiple email address constraints with shared local parts but different domains. A remote attacker can present a certificate chain with malformed email constraints to cause only the last constraint to be applied, leading to improper validation.

This issue only affects Go 1.26 and requires the certificate chain to chain to a trusted root. A trusted CA must issue the malicious certificate.

3) Error Handling (CVE-ID: CVE-2026-27138)

The vulnerability allows a remote attacker to cause a denial of service via application crash during X.509 certificate verification.

The vulnerability exists due to a panic in name constraint checking in crypto/x509 when processing a certificate chain containing a certificate with an empty DNS name and another certificate with excluded name constraints. A remote attacker can send a specially crafted certificate chain to trigger a panic during verification.

This issue only affects Go 1.26 and requires the certificate chain to chain to a trusted root. A trusted CA must issue the malformed certificate.

4) Path traversal (CVE-ID: CVE-2026-27139)

The vulnerability allows a local user to access file metadata outside the intended root directory.

The vulnerability exists due to improper handling of symbolic links in os.FileInfo when listing directory contents via File.ReadDir or File.Readdir on Unix platforms. A local user can replace a path component with a symbolic link to cause lstat to access a file outside the root, allowing metadata disclosure.

The impact is limited to reading file metadata such as size and existence; it does not allow reading or modifying file contents. The user must have access to the directory being listed and the ability to create or modify symbolic links within the path.

5) Cross-site scripting (CVE-ID: CVE-2026-27142)

The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser via cross-site scripting (XSS).

The vulnerability exists due to improper output neutralization in html/template when inserting URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute. A remote attacker can craft a URL that is not properly escaped, leading to script execution when the page is rendered.

Exploitation requires user interaction, as the victim must load the malicious page. This vulnerability affects applications using the html/template package to generate such meta tags.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20260876-1/