Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Go 1.25-openssl security update fixes multiple vulnerabilities
published 7 months ago
Summary
This security update addresses five vulnerabilities and several other issues in the Go 1.25-openssl package. These vulnerabilities could allow an attacker to smuggle malicious code, steal sensitive information, or bypass security checks. We recommend updating to the latest version to ensure your systems remain secure.
What to do
- Update suse go1.25-openssl to version 1.25.8-150000.1.18.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | go1.25-openssl |
< 1.25.8-150000.1.18.1 Fix: upgrade to 1.25.8-150000.1.18.1
|
Original advisory text
Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues:
Update to go 1.25.8 (bsc#1244485, jsc#SLE-18320):
- CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling (bsc#1257692).
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does
not account for the expiration of full certificate chain (bsc#1256818).
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
Changelog:
* go#77253 cmd/compile: miscompile of global array initialization
* go#77406 os: Go 1.25.x regression on RemoveAll for windows
* go#77413 runtime: netpollinit() incorrectly prints the error from linux.Eventfd
* go#77438 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in
pkg-config
* go#77531 net/smtp: expiry date of localhostCert for testing is too short
* go#75844 cmd/compile: OOM killed on linux/arm64
* go#77323 crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs
* go#77425 crypto/tls: CL 737700 broke session resumption on macOS
Update to go 1.25.8 (bsc#1244485, jsc#SLE-18320):
- CVE-2025-61732: cmd/cgo: discrepancy between Go and C/C++ comment parsing allows for C code smuggling (bsc#1257692).
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does
not account for the expiration of full certificate chain (bsc#1256818).
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host (bsc#1259264).
- CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
- CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped (bsc#1259265).
Changelog:
* go#77253 cmd/compile: miscompile of global array initialization
* go#77406 os: Go 1.25.x regression on RemoveAll for windows
* go#77413 runtime: netpollinit() incorrectly prints the error from linux.Eventfd
* go#77438 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in
pkg-config
* go#77531 net/smtp: expiry date of localhostCert for testing is too short
* go#75844 cmd/compile: OOM killed on linux/arm64
* go#77323 crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs
* go#77425 crypto/tls: CL 737700 broke session resumption on macOS
References
- https://www.suse.com/security/cve/CVE-2025-68121 URL
- https://www.suse.com/support/update/announcement/2026/suse-su-20260947-1/ Vendor Advisory
- https://bugzilla.suse.com/1244485 Third Party Advisory
- https://bugzilla.suse.com/1256818 Third Party Advisory
- https://bugzilla.suse.com/1257692 Third Party Advisory
- https://bugzilla.suse.com/1259264 Third Party Advisory
- https://bugzilla.suse.com/1259265 Third Party Advisory
- https://bugzilla.suse.com/1259268 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2025-61732 URL
- https://www.suse.com/security/cve/CVE-2026-25679 URL
- https://www.suse.com/security/cve/CVE-2026-27139 URL
- https://www.suse.com/security/cve/CVE-2026-27142 URL
Timeline
Published20 Mar 2026
Updated21 Mar 2026
First seen21 Mar 2026
Sources
SUSE-SU-2026:0947-1 · OSV
Track software like this
Free during beta