SUSE SLES15 Security Update : go1.26-openssl (SUSE-SU-2026:3799-1)

high Nessus Plugin ID 341021

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3799-1 advisory.

Update to version 1.26.7 cut from the go1.25-fips-release at the revision tagged go1.26.7-1-openssl-fips.

Security issues fixed:

- CVE-2026-33818: encoding/asn1: stack exhaustion when parsing deeply-nested, recursive structures can lead to denial of service (bsc#1275034).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609).
- CVE-2026-56853: net/http: first header read timeout not being applied when a server is configured to support unencrypted HTTP/2 allows for denial of service (bsc#1275028).
- CVE-2026-56858: html/template: wrong JavaScript regexp context tracking after top-level `{` can lead to XSS (bsc#1275033).
- CVE-2026-56859: encoding/xml: stack exhaustion due to recursion depth guard bypass during decoding operations can lead to denial of service (bsc#1275026).
- CVE-2026-56860: net/url: quadratic complexity in `resolvePath` when processing backtrack path elements can lead to denial of service (bsc#1275029).
- CVE-2026-56862: crypto/tls: handshake messages can bypass non-advancing record limit in TLS 1.3, which can lead to a denial of service (bsc#1275032).
- CVE-2026-56864: x/mod/sumdb: a malicious `GOSUMDB` is capable of serving arbitrary module content not contained within the transparency log (bsc#1275025).
- CVE-2026-56865: x/mod/sumdb/tlog: a malicious `GOPROXY` is capable of forging sumdb tiles, which allows for bypass of the `GOSUMDB` check and persistence of attacker-controlled module contents to a local Go module cache (bsc#1275024).

Other updates and bugfixes:

- Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips:
(jsc#SLE-18320).
* Rebase to 1.26.7
* Support `strictfipsruntime` with `no_openssl`
* Fix multiple `no_openssl` build tag issues
- go1.26.7 (released 2026-08-19, boo#1255111):
* go#80927 net/http: `ReadHeaderTimeout` remains active after unencrypted `HTTP/2` handoff
- go1.26.6 (released 2026-08-13):
* includes security fixes to the `go` command, and the `crypto/tls`, `encoding/asn1`, `encoding/xml`, `html/template`, `net`, `net/http`, and `net/url` packages, as well as bug fixes to the compiler, the linker, the runtime, and the `crypto/tls` and `os` packages.
* go#79876 cmd/compile: `prove` misscompilation in `slicemask` folding leaves garbage in the upper bits
* go#80099 cmd/compile: internal compiler error invalid heap allocated var without `Heapaddr`
* go#80131 cmd/link: `peCreateExportFile` generates invalid `.def` file when output name has trailing dot (`c-shared` on Windows)
* go#80365 os: `Root`'s `MkdirAll` can't create paths ending in forward slashes
* go#80367 os: `TestRootMultiReadFile` fails on `netbsd/arm64` after CL 797880
* go#80369 os: `TestRootConsistencyRemoveAll` fails on Plan 9 after CL 797880
* go#80394 runtime: `arm64` found pointer to free object with safe code
* go#80441 runtime: uninitialized register due to wrong ABI in `mach_vm_region_trampoline` leads to `libc` following garbage stack data as a pointer
* go#80478 cmd/compile: `riscv64` miscompiles struct copy, corrupting a `[]byte` slice field
* go#80499 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer
* go#80579 cmd/compile: `regalloc` uses unreliable type data (like `v.Type.IsSigned()`) to choose the restore of spills
* go#80606 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement
* go#80609 net, x/net/dns/dnsmessage: panic when parsing invalid `SVCB` record
* go#80615 cmd/compile: `mips64le` misscompile `OffPtr` by a const which doesn't fit 32bits resulting in panic
* go#80617 cmd/compile: `mips`/`mips64`, multiply/divide results spilled from `HI`/`LO` corrupted w/ big stack frames
* go#80619 cmd/compile: `prove` bug causes invalid indirect call
* go#80715 runtime: `fpTracebackPartialExpand` `SIGSEGV` under high panic load
- Update to version 1.26.5 cut from the go1.25-fips-release branch at the revision tagged go1.26.5-2-openssl-fips:
* Limit `openssl` `RandReader` concurrency

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected go1.26-openssl, go1.26-openssl-doc and / or go1.26-openssl-race packages.

Plugin Details

Severity: High

ID: 341021

File Name: suse_SU-2026-3799-1.nasl

Version: 1.2

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/27/2026

Updated: 8/28/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.17

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-56858

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-56865

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:go1.26-openssl-doc, p-cpe:/a:novell:suse_linux:go1.26-openssl-race, p-cpe:/a:novell:suse_linux:go1.26-openssl

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865

IAVB: 2026-B-0234

SuSE: SUSE-SU-2026:3799-1

Detections

Analytics