Linux · openSUSE Leap · Security advisory · July 13, 2026

OPENSUSE-SU-2026:21319-1: go1.25-openssl security update

OPENSUSE-SU-2026:21319-1, released July 13, 2026, fixes 30 CVEs in go1.25-openssl (version 1.25.12-160000.1.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
30
2 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0090
60th percentile

Priority of the 30 CVEs

Patch now 0 Urgent 2 High 23 Routine 5

Fixed package versions

ProductReleaseFixed in
go1.25-opensslopensuse-leap 16.01.25.12-160000.1.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go9.8 0.0067 None reported
Urgent CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile9.8 0.0055 None reported
High CVE-2025-68121 Unexpected session resumption in crypto/tls10.0 0.0090 None reported
High CVE-2026-33811 Crash when handling long CNAME response in net8.8 0.0088 None reported
High CVE-2026-33814 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 0.0084 None reported
High CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url9.1 0.0083 None reported
High CVE-2026-42499 Quadratic string concatenation in consumePhrase in net/mail8.8 0.0080 None reported
High CVE-2026-39820 Quadratic string concatentation in consumeComment in net/mail8.8 0.0078 None reported
High CVE-2026-39836 Panic in Dial and LookupPort when handling NUL byte on Windows in net7.5 0.0063 None reported
High CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls9.1 0.0063 None reported
High CVE-2026-32280 Unexpected work during chain building in crypto/x5099.1 0.0063 None reported
High CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x5098.2 0.0059 None reported
High CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime8.8 0.0056 None reported
High CVE-2025-61732 Potential code smuggling via doc comments in cmd/cgo8.6 0.0053 None reported
High CVE-2026-39825 ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil7.5 0.0039 None reported
High CVE-2026-27142 URLs in meta content attribute actions are not escaped in html/template7.5 0.0037 None reported
High CVE-2026-39826 Escaper bypass leads to XSS in html/template7.5 0.0037 None reported
High CVE-2026-32281 Inefficient policy validation in crypto/x5099.1 0.0036 None reported
High CVE-2026-39823 Bypass of meta content URL escaping causes XSS in html/template7.5 0.0031 None reported
High CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix9.1 0.0030 None reported
High CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile9.0 0.0027 None reported
High CVE-2026-39822 Root escape via symlink plus trailing slash in os8.2 0.0023 None reported
High CVE-2026-42501 Malicious module proxy can bypass checksum database in cmd/go7.5 0.0023 None reported
High CVE-2026-39819 Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go7.5 0.0018 None reported
High CVE-2026-39817 Invoking "go tool pack" does not sanitize output paths in cmd/go7.5 0.0017 None reported
Showing 1 to 25 of 30 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.