SB20260731148 - SUSE update for go1.25-openssl
Published: July 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-25679)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass URL parsing validation and potentially access unintended resources.
The vulnerability exists due to insufficient validation in net/url.Parse when handling IPv6 literals not located at the start of the host component. A remote attacker can send a specially crafted URL with an IPv6 literal preceded by garbage characters to bypass proper parsing and potentially redirect requests.
This issue affects any application using net/url.Parse to process untrusted URLs. The incorrect parsing may lead to misrouting or injection of unintended host components.
2) Path traversal (CVE-ID: CVE-2026-27139)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to access file metadata outside the intended root directory.
The vulnerability exists due to improper handling of symbolic links in os.FileInfo when listing directory contents via File.ReadDir or File.Readdir on Unix platforms. A local user can replace a path component with a symbolic link to cause lstat to access a file outside the root, allowing metadata disclosure.
The impact is limited to reading file metadata such as size and existence; it does not allow reading or modifying file contents. The user must have access to the directory being listed and the ability to create or modify symbolic links within the path.
3) Cross-site scripting (CVE-ID: CVE-2026-27142)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser via cross-site scripting (XSS).
The vulnerability exists due to improper output neutralization in html/template when inserting URLs into the content attribute of HTML meta tags with an http-equiv="refresh" attribute. A remote attacker can craft a URL that is not properly escaped, leading to script execution when the page is rendered.
Exploitation requires user interaction, as the victim must load the malicious page. This vulnerability affects applications using the html/template package to generate such meta tags.
4) Resource exhaustion (CVE-ID: CVE-2026-27145)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in crypto/x509 certificate hostname verification when processing certificates with a large DNS subject alternative name list. A remote attacker can present a specially crafted certificate to cause a denial of service.
The excessive verification cost occurs before the certificate chain is built, so the overhead is incurred even for untrusted certificates.
5) Link following (CVE-ID: CVE-2026-39822)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to access files outside the intended root directory.
The vulnerability exists due to improper link resolution in os.Root file-opening functions when processing a path whose final component is a symbolic link and the path ends with a trailing slash. A local user can supply a crafted path to access files outside the intended root directory.
This issue affects Unix systems.
6) Resource exhaustion (CVE-ID: CVE-2026-42504)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in WordDecoder.DecodeHeader in the mime package when parsing a maliciously crafted MIME header containing many invalid encoded-words. A remote attacker can send a specially crafted MIME header to cause a denial of service.
7) Information disclosure (CVE-ID: CVE-2026-42505)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper information exposure in crypto/tls when performing handshakes that use Encrypted Client Hello. A remote attacker can observe network traffic to disclose sensitive information.
The issue can de-anonymize handshakes by exposing pre-shared key identities in the unencrypted client hello.
8) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-42507)
CWE-ID: CWE-117 - Improper Output Neutralization for Logs
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to inject misleading content into error messages or logs.
The vulnerability exists due to improper output neutralization in the net/textproto package when returning errors that include user-supplied input. A remote attacker can supply crafted input to inject misleading content into error messages or logs.
Remediation
Install update from vendor's website.