Security update for go-sendxmpp
This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: * Add Ox support to http-upload. * Add Ox support for private group chats. * Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5). Changed: * Fix --ox-delete-nodes. * Fix receiving of 1-1 messages while joined in a MUC. * Use go-sendxmpp + a random ID as fallback MUC alias. * Strip leading "xmpp:" from recipients. * Strip trailing "?join" from MUC JIDs. * Add context for timeouts in stanza handling. * Check ID for disco items reply (requires go-xmpp >= v0.3.6). * Reduce channel buffer size to 1 where only one item will be returned. * Deprecate legacy PGP. * CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538) Bump circl to 1.6.3 * CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617) Bump net to 0.56.0 - Update to 0.15.8: * Fix windows build (windows doesn't support syscalls Setgid and Setuid). - Update to 0.15.7: * Fix http-upload with legacy PGP encryption. * Fix reading of environment variables. * Fix a bug in looking up host meta 2. * Try to drop root privileges before connecting to the server. * Fix crash if a config key has no value. * Use a salt for stored FAST token. * Increase scrypt iterations for storing FAST token from 32768 to 65536. * Log a warning when --no-tls-verify or -n is set. - Update to 0.15.6: Added: * New config option allow_plain. Changed: * Explain each configuration option in manpage go-sendxmpp(5). * Improve config parsing robustness. * Update link in manpage as Gitlab calls issues now work items. * Recognize stanza size limit updates after authentication (via go-xmpp >= v0.3.3). * Tell connection target in error message when failing to connect. - Drop tar-scm service and use regular tarball and go_modules - Update to 0.15.5: * Fix SASL SCRAM Downgrade Protection in case of server providing different mechanisms for SASL and SASL2 (requires go-xmpp >0 v0.3.2). - Update to 0.15.4: * http-upload: Manually set content length for HTTP request (fixes issues with certain http modules/proxies). - Update to 0.15.3: * Fix PLAIN authentication for SASL2 (requires go-xmpp >= v0.3.1). - Update to 0.15.2: * Use UUIDv7 instead of UUIDv4 for stanza IDs (requires go-xmpp >= v0.2.19). * Fix stanza syntax error for legacy PGP messages. * Print error if legacy PGP and Ox are requested simultaneously. * Reworked OOB file sending and http-upload to use new functions from go-xmpp library (requires go-xmpp >= v0.3.0). * Try password login if FAST login fails.
Security update for go-sendxmpp
Description
This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: * Add Ox support to http-upload. * Add Ox support for private group chats. * Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5). Changed: * Fix --ox-delete-nodes. * Fix receiving of 1-1 messages while joined in a MUC. * Use go-sendxmpp + a random ID as fallback MUC alias. * Strip leading "xmpp:" from recipients. * Strip trailing "?join" from MUC JIDs. * Add context for timeouts in stanza handling. * Check ID for disco items reply (requires go-xmpp >= v0.3.6). * Reduce channel buffer size to 1 where only one item will be returned. * Deprecate legacy PGP. * CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538) Bump circl to 1.6.3 * CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617) Bump net to 0.56.0 - Update to 0.15.8: * Fix windows build (windows doesn't support syscalls Setgid and Setuid). - Update to 0.15.7: * Fix http-upload with legacy PGP encryption. * Fix reading of environment variables. * Fix a bug in looking up host meta 2. * Try to drop root privileges before connecting to the server. * Fix crash if a config key has no value. * Use a salt for stored FAST token. * Increase scrypt iterations for storing FAST token from 32768 to 65536. * Log a warning when --no-tls-verify or -n is set. - Update to 0.15.6: Added: * New config option allow_plain. Changed: * Explain each configuration option in manpage go-sendxmpp(5). * Improve config parsing robustness. * Update link in manpage as Gitlab calls issues now work items. * Recognize stanza size limit updates after authentication (via go-xmpp >= v0.3.3). * Tell connection target in error message when failing to connect. - Drop tar-scm service and use regular tarball and go_modules - Update to 0.15.5: * Fix SASL SCRAM Downgrade Protection in case of server providing different mechanisms for SASL and SASL2 (requires go-xmpp >0 v0.3.2). - Update to 0.15.4: * http-upload: Manually set content length for HTTP request (fixes issues with certain http modules/proxies). - Update to 0.15.3: * Fix PLAIN authentication for SASL2 (requires go-xmpp >= v0.3.1). - Update to 0.15.2: * Use UUIDv7 instead of UUIDv4 for stanza IDs (requires go-xmpp >= v0.2.19). * Fix stanza syntax error for legacy PGP messages. * Print error if legacy PGP and Ox are requested simultaneously. * Reworked OOB file sending and http-upload to use new functions from go-xmpp library (requires go-xmpp >= v0.3.0). * Try password login if FAST login fails.
Affected software
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2026:21277-1
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-39821"]
- State
- PUBLISHED
Threat ID: 6aab496f55bf5e2cf5990dfb
Added to database: 09/17/2026, 01:59:11 UTC
Last updated: 09/17/2026, 02:02:24 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.