SUSE SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3800-1)

high Nessus Plugin ID 341000

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3800-1 advisory.

Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips.

Security issues fixed:

- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS (bsc#1275033).
- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to denial of service (bsc#1275029).
- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

- Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips:
(jsc#SLE-18320):
* Rebase to 1.25.14
- go1.25.14 (released 2026-08-19, boo#1244485):
* go#80926 net/http: `ReadHeaderTimeout` remains active after unencrypted HTTP/2 handoff
- go1.25.13 (released 2026-08-13):
* includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the runtime, and the `crypto/tls` and `os` packages.
* go#79876 cmd/compile: `prove` miscompilation in `slicemask` folding leaves garbage in the upper bits
* go#80098 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
* go#80364 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
* go#80366 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
* go#80368 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
* go#80393 runtime: `arm64` found pointer to free object with safe code
* go#80440 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following garbage stack data as a pointer
* go#80477 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
* go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
* go#80578 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of spills
* go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
* go#80614 cmd/compile: `mips64le` miscompiles `OffPtr` by a const which doesn't fit 32bits resulting in panic
* go#80616 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames
* go#80618 cmd/compile: `prove` bug causes invalid indirect call
* go#80737 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
- Update to version 1.25.12 cut from the go1.25-fips-release branch at the revision tagged go1.25.12-2-openssl-fips:
* Limit openssl `RandReader` concurrency (#374)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected go1.25-openssl, go1.25-openssl-doc and / or go1.25-openssl-race packages.

Plugin Details

Severity: High

ID: 341000

File Name: suse_SU-2026-3800-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/27/2026

Updated: 8/27/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.17

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-56858

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-56865

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:go1.25-openssl-doc, p-cpe:/a:novell:suse_linux:go1.25-openssl-race, p-cpe:/a:novell:suse_linux:go1.25-openssl

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865

SuSE: SUSE-SU-2026:3800-1

Detections

Analytics