Описание
Security update for go1.26
This update for go1.26 fixes the following issues:
Update to go 1.26.10 (bsc#1255111):
- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).
- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).
- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1255111
- SUSE Bug 1284770
- SUSE Bug 1284772
- SUSE Bug 1286261
- SUSE Bug 1286317
- SUSE CVE CVE-2026-111943 page
- SUSE CVE CVE-2026-78663 page
- SUSE CVE CVE-2026-78669 page
Описание
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
Затронутые продукты
Ссылки
- CVE-2026-111943
- SUSE Bug 1286317
Описание
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Затронутые продукты
Ссылки
- CVE-2026-78663
- SUSE Bug 1284770
- SUSE Bug 1286126
Описание
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Затронутые продукты
Ссылки
- CVE-2026-78669
- SUSE Bug 1284772