{"schema_version":"1.9.0","id":"SUSE-SU-2026:3640-1","published":"2026-08-18T09:05:33Z","modified":"2026-08-18T17:30:04.203009344Z","related":["CVE-2026-33818","CVE-2026-39821","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56864","CVE-2026-56865"],"upstream":["CVE-2026-33818","CVE-2026-39821","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56864","CVE-2026-56865"],"summary":"Security update for go1.25","details":"This update for go1.25 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-33818: encoding/asn1: enforce maximum recursion depth (bsc#1275034).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266609).\n- CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check (bsc#1275028).\n- CVE-2026-56858: html/template: fix Javascript regexp context tracking (bsc#1275033).\n- CVE-2026-56859: encoding/xml: add recursion depth guard during decode (bsc#1275026).\n- CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath (bsc#1275029).\n- CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake (bsc#1275032).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n\nNon security issue fixed:\n\n- go1.25 release tracking (bsc#1244485).\n\nChanges for go1.25:\n\n- update to go1.25.13\n * go#79875 cmd/compile: prove misscompilation in slicemask folding leaves garbage in upper bits\n * go#80098 cmd/compile: internal compiler error invalid heap allocated var without Heapaddr\n * go#80364 os: Root's MkdirAll can't create paths ending in forward slashes\n * go#80366 os: TestRootMultiReadFile fails on netbsd/arm64 after CL 797880\n * go#80368 os: TestRootConsistencyRemoveAll fails on Plan 9 after CL 797880\n * go#80393 runtime: arm64 found pointer to free object with safe code\n * go#80440 runtime: uninitialized register due to wrong ABI in mach_vm_region_trampoline leads to libc following garbage stack data as a pointer\n * go#80477 cmd/compile: riscv64 miscompiles struct copy, corrupting a []byte slice field\n * go#80500 runtime: js/wasm: 'found bad pointer in Go heap' -- link-layout-constant value recorded as a pointer in the write-barrier buffer\n * go#80578 cmd/compile: regalloc uses unreliable type data (like v.Type.IsSigned()) to choose the restore of spills\n * go#80605 crypto/tls: escape hatch for FIPS 140-3 mode Extended Master Secret enforcement\n * go#80614 cmd/compile: mips64le misscompile OffPtr by a const which doesn't fit 32bits resulting in panic\n * go#80616 cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames\n * go#80618 cmd/compile: prove bug causes invalid indirect call\n * go#80737 runtime: fpTracebackPartialExpand SIGSEGV under high panic load\n","affected":[{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}},{"package":{"name":"go1.25","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-150000.1.50.1"}]}],"ecosystem_specific":{"binaries":[{"go1.25":"1.25.13-150000.1.50.1","go1.25-doc":"1.25.13-150000.1.50.1","go1.25-race":"1.25.13-150000.1.50.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3640-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263640-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1244485"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266609"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275024"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275025"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275026"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275028"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275029"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275032"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275033"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275034"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33818"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56853"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56858"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56859"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56860"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56862"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56864"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56865"}]}