Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2096-1

Опубликовано: 27 мая 2026
Источник: suse-cvrf

Описание

Security update for yq

This update for yq fixes the following issues

  • CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241719).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251339).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251540).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1266248).

Changes for yq:

  • update to v4.53.2

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP7
yq-4.53.2-150500.3.6.1

Ссылки

Описание

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.2-150500.3.6.1
Ссылки

Описание

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.2-150500.3.6.1
Ссылки

Описание

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.2-150500.3.6.1
Ссылки

Описание

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:yq-4.53.2-150500.3.6.1
Ссылки