Security update for kubevirt
This update for kubevirt fixes the following issues: - Security: re-vendor the bundled Go dependencies (no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor): * golang.org/x/net v0.48.0 -> v0.55.0: CVE-2026-33814 (bsc#1265736), CVE-2026-39821 (bsc#1266575), CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267120) * golang.org/x/crypto v0.46.0 -> v0.52.0: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 (bsc#1266151) * github.com/moby/spdystream v0.5.0 -> v0.5.1 folded into the vendor tree; - Build with Go >= 1.25 (required by golang.org/x/net 0.55).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for kubevirt fixes the following issues: - Security: re-vendor the bundled Go dependencies (no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor): * golang.org/x/net v0.48.0 -> v0.55.0: CVE-2026-33814 (bsc#1265736), CVE-2026-39821 (bsc#1266575), CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267120) * golang.org/x/crypto v0.46.0 -> v0.52.0: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 (bsc#1266151) * github.com/moby/spdystream v0.5.0 -> v0.5.1 folded into the vendor tree; - Build with Go >= 1.25 (required by golang.org/x/net 0.55).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1262265
- https://bugzilla.suse.com/1265736
- https://bugzilla.suse.com/1266151
- https://bugzilla.suse.com/1266575
- https://bugzilla.suse.com/1267120
- https://www.suse.com/security/cve/CVE-2026-25680
- https://www.suse.com/security/cve/CVE-2026-25681
- https://www.suse.com/security/cve/CVE-2026-27136
- https://www.suse.com/security/cve/CVE-2026-33814
- https://www.suse.com/security/cve/CVE-2026-35469
- https://www.suse.com/security/cve/CVE-2026-39821
- https://www.suse.com/security/cve/CVE-2026-39827
- https://www.suse.com/security/cve/CVE-2026-39828
- https://www.suse.com/security/cve/CVE-2026-39829
- https://www.suse.com/security/cve/CVE-2026-39830
- https://www.suse.com/security/cve/CVE-2026-39831
- https://www.suse.com/security/cve/CVE-2026-39832
- https://www.suse.com/security/cve/CVE-2026-39833
- https://www.suse.com/security/cve/CVE-2026-39834
- https://www.suse.com/security/cve/CVE-2026-39835
- https://www.suse.com/security/cve/CVE-2026-42502
- https://www.suse.com/security/cve/CVE-2026-42506
- https://www.suse.com/security/cve/CVE-2026-42508
- https://www.suse.com/security/cve/CVE-2026-46595
- https://www.suse.com/security/cve/CVE-2026-46597
- https://www.suse.com/security/cve/CVE-2026-46598
- https://www.suse.com/support/update/announcement/2026/suse-su-20263203-1/