OPENSUSE-SU-2026:20976-1 Security update for go1.26

This update for go1.26 fixes the following issues Update to go1.26.4 bsc1255111: - CVE-2026-27145: crypto/x509: split candidate hostname only once bsc1267450. - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader bsc1267442. - CVE-2026-42507: net/textproto: arbitrary input are...

BELL-CVE-2026-42504

Bulletin has no description...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: grafana-operator, cluster-autoscaler, metrics-server, tofu-controller, newrelic-nri-kube-events, rancher-webhook, ingress-nginx-controller, runc, kuberay-operator, tigera-operator, cass-operator, crossplane-provider-aws-lambda, crossplane-provider-aws-route53,...

CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...