OPENSUSE-SU-2026:12529-1
Vulnerability from csaf_opensuse - Published: 2026-11-11 00:00 - Updated: 2026-11-12 11:01Summary
go1.26-1.26.11-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: go1.26-1.26.11-1.1 on GA media
Description of the patch: These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12529
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.4 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
7.4 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-97033
Threats
Impact
important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "go1.26-1.26.11-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-12529",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/2026/opensuse-su-2026_12529-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97033 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97033/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97034 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97034/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97035 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97035/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97036 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97036/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97037 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97037/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97038 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97038/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97039 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97039/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97040 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97040/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97041 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97041/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97042 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97042/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97043 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97043/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-97054 page",
"url": "https://www.suse.com/security/cve/CVE-2026-97054/"
}
],
"title": "go1.26-1.26.11-1.1 on GA media",
"tracking": {
"current_release_date": "2026-11-12T11:01:44Z",
"generator": {
"date": "2026-11-11T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:12529-1",
"initial_release_date": "2026-11-11T00:00:00Z",
"revision_history": [
{
"date": "2026-11-11T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-11-12T11:01:44Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "go1.26-0:1.26.11-1.1.aarch64",
"product": {
"name": "go1.26-0:1.26.11-1.1.aarch64",
"product_id": "go1.26-0:1.26.11-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26@1.26.11-1.1?arch=aarch64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-doc-0:1.26.11-1.1.aarch64",
"product": {
"name": "go1.26-doc-0:1.26.11-1.1.aarch64",
"product_id": "go1.26-doc-0:1.26.11-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-doc@1.26.11-1.1?arch=aarch64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-race-0:1.26.11-1.1.aarch64",
"product": {
"name": "go1.26-race-0:1.26.11-1.1.aarch64",
"product_id": "go1.26-race-0:1.26.11-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-race@1.26.11-1.1?arch=aarch64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-0:1.26.11-1.1.ppc64le",
"product": {
"name": "go1.26-0:1.26.11-1.1.ppc64le",
"product_id": "go1.26-0:1.26.11-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26@1.26.11-1.1?arch=ppc64le\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-doc-0:1.26.11-1.1.ppc64le",
"product": {
"name": "go1.26-doc-0:1.26.11-1.1.ppc64le",
"product_id": "go1.26-doc-0:1.26.11-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-doc@1.26.11-1.1?arch=ppc64le\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-race-0:1.26.11-1.1.ppc64le",
"product": {
"name": "go1.26-race-0:1.26.11-1.1.ppc64le",
"product_id": "go1.26-race-0:1.26.11-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-race@1.26.11-1.1?arch=ppc64le\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-0:1.26.11-1.1.s390x",
"product": {
"name": "go1.26-0:1.26.11-1.1.s390x",
"product_id": "go1.26-0:1.26.11-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26@1.26.11-1.1?arch=s390x\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-doc-0:1.26.11-1.1.s390x",
"product": {
"name": "go1.26-doc-0:1.26.11-1.1.s390x",
"product_id": "go1.26-doc-0:1.26.11-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-doc@1.26.11-1.1?arch=s390x\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-race-0:1.26.11-1.1.s390x",
"product": {
"name": "go1.26-race-0:1.26.11-1.1.s390x",
"product_id": "go1.26-race-0:1.26.11-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-race@1.26.11-1.1?arch=s390x\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go1.26-0:1.26.11-1.1.x86_64",
"product": {
"name": "go1.26-0:1.26.11-1.1.x86_64",
"product_id": "go1.26-0:1.26.11-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26@1.26.11-1.1?arch=x86_64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-doc-0:1.26.11-1.1.x86_64",
"product": {
"name": "go1.26-doc-0:1.26.11-1.1.x86_64",
"product_id": "go1.26-doc-0:1.26.11-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-doc@1.26.11-1.1?arch=x86_64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "go1.26-race-0:1.26.11-1.1.x86_64",
"product": {
"name": "go1.26-race-0:1.26.11-1.1.x86_64",
"product_id": "go1.26-race-0:1.26.11-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:golang:go:1.26.11:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/go1.26-race@1.26.11-1.1?arch=x86_64\u0026upstream=go1.26-0:1.26.11-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-0:1.26.11-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64"
},
"product_reference": "go1.26-0:1.26.11-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-0:1.26.11-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le"
},
"product_reference": "go1.26-0:1.26.11-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-0:1.26.11-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x"
},
"product_reference": "go1.26-0:1.26.11-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-0:1.26.11-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64"
},
"product_reference": "go1.26-0:1.26.11-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-0:1.26.11-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64"
},
"product_reference": "go1.26-doc-0:1.26.11-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-0:1.26.11-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le"
},
"product_reference": "go1.26-doc-0:1.26.11-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-0:1.26.11-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x"
},
"product_reference": "go1.26-doc-0:1.26.11-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-doc-0:1.26.11-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64"
},
"product_reference": "go1.26-doc-0:1.26.11-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-0:1.26.11-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64"
},
"product_reference": "go1.26-race-0:1.26.11-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-0:1.26.11-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le"
},
"product_reference": "go1.26-race-0:1.26.11-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-0:1.26.11-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x"
},
"product_reference": "go1.26-race-0:1.26.11-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go1.26-race-0:1.26.11-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
},
"product_reference": "go1.26-race-0:1.26.11-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-97033",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97033"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in \"#cgo\" directives. Specifically, \"--sysroot\" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; \"-target\" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; \"-isysroot\" and \"-Wl,-syslibroot\" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and \"-x\" permitted specifying arbitrary compiler input languages beyond those supported by cgo. \"--sysroot\" and \"-target\" are now disallowed in \"#cgo\" flags, \"-isysroot\" and \"-Wl,-syslibroot\" are verified not to point to regular files, and \"-x\" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97033",
"url": "https://www.suse.com/security/cve/CVE-2026-97033"
},
{
"category": "external",
"summary": "SUSE Bug 1289978 for CVE-2026-97033",
"url": "https://bugzilla.suse.com/1289978"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97033"
},
{
"cve": "CVE-2026-97034",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97034"
}
],
"notes": [
{
"category": "general",
"text": "When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\"). When linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC\u0027s built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\". The go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97034",
"url": "https://www.suse.com/security/cve/CVE-2026-97034"
},
{
"category": "external",
"summary": "SUSE Bug 1289979 for CVE-2026-97034",
"url": "https://bugzilla.suse.com/1289979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97034"
},
{
"cve": "CVE-2026-97035",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97035"
}
],
"notes": [
{
"category": "general",
"text": "When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via \"-gen-*\" or \"-gnat*\" flags in \"#cgo\" directives. The \"-g*\" wildcard in the compiler and linker flag allowlists previously matched Clang\u0027s two-argument \"-gen-cdb-fragment-path \u003cdir\u003e\" flag and GCC\u0027s two-argument \"-gnatO \u003cfile\u003e\" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker. \"-gen-*\" and \"-gnat*\" flags are now disallowed in \"#cgo\" compiler and linker flags.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97035",
"url": "https://www.suse.com/security/cve/CVE-2026-97035"
},
{
"category": "external",
"summary": "SUSE Bug 1289980 for CVE-2026-97035",
"url": "https://bugzilla.suse.com/1289980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97035"
},
{
"cve": "CVE-2026-97036",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97036"
}
],
"notes": [
{
"category": "general",
"text": "On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library \u003cpath\u003e\" in a \"#cgo LDFLAGS\" directive. The Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97036",
"url": "https://www.suse.com/security/cve/CVE-2026-97036"
},
{
"category": "external",
"summary": "SUSE Bug 1289981 for CVE-2026-97036",
"url": "https://bugzilla.suse.com/1289981"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97036"
},
{
"cve": "CVE-2026-97037",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97037"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\". Split \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97037",
"url": "https://www.suse.com/security/cve/CVE-2026-97037"
},
{
"category": "external",
"summary": "SUSE Bug 1289982 for CVE-2026-97037",
"url": "https://bugzilla.suse.com/1289982"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97037"
},
{
"cve": "CVE-2026-97038",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97038"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package containing \".syso\" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files-including \".syso\" files, direct object or library inputs in \"#cgo LDFLAGS\", and libraries in \"-L\" directories-were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or \".syso\" files (or loaded via \"-l:\u003cfilename\u003e\" or \"-l\" containing path separators), injecting unallowlisted linker flags via PE/COFF \".drectve\" sections on Windows or Mach-O \"LC_LINKER_OPTION\" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that \".syso\" files, direct linker inputs, and libraries in \"-L\" directories are valid binary objects or archives that do not contain unallowlisted \".drectve\" directives, \"LC_LINKER_OPTION\" load commands, or LTO IR sections, and disallows \"-l:\u003cfilename\u003e\" and \":\", \"=\", or path separators in \"-l\" flags.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97038",
"url": "https://www.suse.com/security/cve/CVE-2026-97038"
},
{
"category": "external",
"summary": "SUSE Bug 1289983 for CVE-2026-97038",
"url": "https://bugzilla.suse.com/1289983"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97038"
},
{
"cve": "CVE-2026-97039",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97039"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package that uses \"#cgo pkg-config:\" directives could load untrusted pkg-config \".pc\" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted \"--with-path=\" and \"--personality=\", allowed \"--define-variable=\" values beginning with \"=\" or \"$\" (which can rewrite paths in system \".pc\" files into sysroot-prefixed \"-L=\" or \"-L$SYSROOT\" linker search paths), and allowed package arguments ending in \".pc\" or containing path separators or \"..\", which caused pkg-config to load local \".pc\" files directly from the package directory. In addition, flags returned by \"pkg-config --cflags\" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows \"--with-path=\", \"--personality=\", leading \"=\" or \"$\" characters in \"--define-variable=\" values, and local \".pc\" paths in \"#cgo pkg-config:\" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97039",
"url": "https://www.suse.com/security/cve/CVE-2026-97039"
},
{
"category": "external",
"summary": "SUSE Bug 1289984 for CVE-2026-97039",
"url": "https://bugzilla.suse.com/1289984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97039"
},
{
"cve": "CVE-2026-97040",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97040"
}
],
"notes": [
{
"category": "general",
"text": "Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds. The linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97040",
"url": "https://www.suse.com/security/cve/CVE-2026-97040"
},
{
"category": "external",
"summary": "SUSE Bug 1289985 for CVE-2026-97040",
"url": "https://bugzilla.suse.com/1289985"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97040"
},
{
"cve": "CVE-2026-97041",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97041"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,\u003cpath\u003e\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=\u003cpath\u003e\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97041",
"url": "https://www.suse.com/security/cve/CVE-2026-97041"
},
{
"category": "external",
"summary": "SUSE Bug 1289986 for CVE-2026-97041",
"url": "https://bugzilla.suse.com/1289986"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97041"
},
{
"cve": "CVE-2026-97042",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97042"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l\u003cname\u003e\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97042",
"url": "https://www.suse.com/security/cve/CVE-2026-97042"
},
{
"category": "external",
"summary": "SUSE Bug 1289987 for CVE-2026-97042",
"url": "https://bugzilla.suse.com/1289987"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97042"
},
{
"cve": "CVE-2026-97043",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97043"
}
],
"notes": [
{
"category": "general",
"text": "Building a malicious package that uses cgo could bypass \"#cgo LDFLAGS\" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in \"//go:cgo_ldflag\" directives. When \"cmd/cgo\" generates \"_cgo_gotypes.go\", it quotes each \"#cgo LDFLAGS\" argument with strconv.Quote in a \"//go:cgo_ldflag\" directive, but \"cmd/compile\" and \"cmd/go\" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command\u0027s flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. \"cmd/compile\" and \"cmd/go\" now properly handle backslash-escaped quotes and unquote \"//go:cgo_*\" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97043",
"url": "https://www.suse.com/security/cve/CVE-2026-97043"
},
{
"category": "external",
"summary": "SUSE Bug 1289988 for CVE-2026-97043",
"url": "https://bugzilla.suse.com/1289988"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97043"
},
{
"cve": "CVE-2026-97054",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-97054"
}
],
"notes": [
{
"category": "general",
"text": "For HTTP/1 servers, when MaxBytesReader\u0027s limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-97054",
"url": "https://www.suse.com/security/cve/CVE-2026-97054"
},
{
"category": "external",
"summary": "SUSE Bug 1289989 for CVE-2026-97054",
"url": "https://bugzilla.suse.com/1289989"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-doc-0:1.26.11-1.1.x86_64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.aarch64",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.ppc64le",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.s390x",
"openSUSE Tumbleweed:go1.26-race-0:1.26.11-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-11-11T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-97054"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.