Mageia alert MGASA-2026-0341 (golang)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2026-0341: Updated golang packages fix security vulnerabilities
Date:
             
 
Sun, 30 Aug 2026 06:17:56 +0200
Message-ID:
             
 
<20260830041756.9E974A0EAC@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2026-0341 - Updated golang packages fix security vulnerabilities

Publication date: 30 Aug 2026
URL: https://advisories.mageia.org/MGASA-2026-0341.html
Type: security
Affected Mageia releases: 10, 9
CVE: CVE-2026-56865,
     CVE-2026-56864,
     CVE-2026-56859,
     CVE-2026-56853,
     CVE-2026-56860,
     CVE-2026-46600,
     CVE-2026-56862,
     CVE-2026-56858,
     CVE-2026-39821,
     CVE-2026-33818

Description:
CVE-2026-56865  A malicious GOPROXY was previously capable of forging up
to two sumdb tiles that allow for a requested module to bypass the
GOSUMDB check and persist attacker-controlled module content to a local
Go module cache.
CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency log.
CVE-2026-56859 Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56853 When a server is configured to support unencrypted
HTTP/2, it reads a few bytes from each new connection to see if they
contain the HTTP/2 client preface. Previously, this was being done with
no timeout applied. ReadHeaderTimeout is now applied for this.
CVE-2026-56860 Previously, resolving relative paths containing parent
directory (|..|) segments performed string conversions and buffer
rewrites on each step, resulting in quadratic time complexity and high
memory allocation overhead.
CVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the
size of a parameter value overflows the message buffer.
CVE-2026-56862 Previously, we always counted handshake messages, such as
KeyUpdate, as state-advancing, regardless of whether a handshake has
been completed or not. As a result, a malicious client can keep sending
KeyUpdate messages to force the server to keep performing key derivation
operations indefinitely.
CVE-2026-56858 Previously, pathological inputs could close an unescaped
|/| early, allowing for attack-controlled data to inject arbitrary
content, potentially leading to XSS.
CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted
Punycode-encoded labels that decode to an ASCII-only label. For example,
ToUnicode("xn--example-.com") incorrectly returned the name
"example.com" rather than an error.
CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack
exhaustion when parsing deeply-nested, recursive structures.

References:
- https://bugs.mageia.org/show_bug.cgi?id=36142
- https://www.openwall.com/lists/oss-security/2026/08/13/13
- https://www.cve.org/CVERecord?id=CVE-2026-56865
- https://www.cve.org/CVERecord?id=CVE-2026-56864
- https://www.cve.org/CVERecord?id=CVE-2026-56859
- https://www.cve.org/CVERecord?id=CVE-2026-56853
- https://www.cve.org/CVERecord?id=CVE-2026-56860
- https://www.cve.org/CVERecord?id=CVE-2026-46600
- https://www.cve.org/CVERecord?id=CVE-2026-56862
- https://www.cve.org/CVERecord?id=CVE-2026-56858
- https://www.cve.org/CVERecord?id=CVE-2026-39821
- https://www.cve.org/CVERecord?id=CVE-2026-33818

SRPMS:
- 10/core/golang-1.25.13-1.mga10
- 9/core/golang-1.25.13-1.mga9