[scarthgap,25/26] go: set status for CVE-2026-39836

Message ID	324359dcb7cbeb15ef51f5cc18924f590c81b1de.1782220259.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 25/26] go: set status for CVE-2026-39836 Date: Tue, 23 Jun 2026 15:14:06 +0200 Message-ID: <324359dcb7cbeb15ef51f5cc18924f590c81b1de.1782220259.git.yoann.congal@smile.fr> In-Reply-To: <cover.1782220259.git.yoann.congal@smile.fr> References: <cover.1782220259.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/26] pseudo: Update to version 1.9.8 \| expand [scarthgap,01/26] pseudo: Update to version 1.9.8 [scarthgap,02/26] openssh: fix CVE-2026-35386 [scarthgap,03/26] tiff: fix CVE-2026-4775 [scarthgap,04/26] go: fix CVE-2025-58183 [scarthgap,05/26] go: fix CVE-2026-25679 [scarthgap,06/26] go: fix CVE-2026-32288 [scarthgap,07/26] binutils: Fix CVE-2025-69644 [scarthgap,08/26] python3: Fix CVE-2026-3644 and CVE-2026-0672 [scarthgap,09/26] python3: Fix CVE-2026-4519 and CVE-2026-4786 [scarthgap,10/26] python3: Fix CVE-2026-6019 [scarthgap,11/26] python3: Fix CVE-2025-13462 [scarthgap,12/26] qemu: Fix CVE-2024-6519 [scarthgap,13/26] dpkg: Fix CVE-2026-2219 [scarthgap,14/26] libsolv: fix CVE-2026-9150 [scarthgap,15/26] openssl: upgrade 3.5.6 -> 3.5.7 [scarthgap,16/26] libinput: fix for CVE-2026-50292 [scarthgap,17/26] gdb: backport a patch to fix static_assert in recent GCC [scarthgap,18/26] oeqa/core/runner: stub addDuration in OETestResult [scarthgap,19/26] classes/gtk-icon-cache: fix libdir passed to the postrm intercept [scarthgap,20/26] python3: CVE-2026-3087 not applicable [scarthgap,21/26] bzip2: set CVE_PRODUCT [scarthgap,22/26] apr-util: Add CVE_PRODUCT to support product name [scarthgap,23/26] apr: Add CVE_PRODUCT to support product name [scarthgap,24/26] go-binary-native: set status for CVE-2026-39836 [scarthgap,25/26] go: set status for CVE-2026-39836 [scarthgap,26/26] rust,libstd-rs: set status for CVE-2024-3566

Message ID

324359dcb7cbeb15ef51f5cc18924f590c81b1de.1782220259.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 25/26] go: set status for CVE-2026-39836
Date: Tue, 23 Jun 2026 15:14:06 +0200
Message-ID: 
 <324359dcb7cbeb15ef51f5cc18924f590c81b1de.1782220259.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1782220259.git.yoann.congal@smile.fr>
References: <cover.1782220259.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/26] pseudo: Update to version 1.9.8 | expand

Commit Message

Yoann Congal June 23, 2026, 1:14 p.m. UTC

From: Sudhir Dumbhare <sudumbha@cisco.com>

This issue affects Windows only. The net.Dial and net.LookupPort
functions can panic when given input containing a NUL byte.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-39836
https://security-tracker.debian.org/tracker/CVE-2026-39836

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-devtools/go/go-1.22.12.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index f85104d6f15..c825ebd25a3 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -65,3 +65,4 @@  SRC_URI += "\
 SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
 
 CVE_STATUS[CVE-2025-0913] = "not-applicable-platform: Issue only applies on Windows"
+CVE_STATUS[CVE-2026-39836] = "not-applicable-platform: Issue only applies on Windows"

[scarthgap,25/26] go: set status for CVE-2026-39836

Commit Message

Patch