[Medium] patch golang-1.26.5 for CVE-2026-46600.

[AkarshHCL]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Vulnerability Summary

This PR fixes CVE-2026-46600,Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. .

Backport adaptations for golang-1.26.5

1. Removed the tests from patch as their is no check section in our spec. Even the file to which those tests are being added is not present in our sources.
2. Rest fix applies as it is as in upstream patch.
3. But tested the test present in upstream patch against the fixed rpms and unfixed rpms output of both pasted in the test methodology section.

Change Log

• SPECS/golang/golang.spec
• SPECS/golang/CVE-2026-46600.patch

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-46600

Test Methodology

Screenshot of successful local build-

patch is getting applied cleanly-

Tried the test present in the upstream against the fixed and unfixed rpms patch ran test with -v option it is required to Go's own verbose flag — produces the === RUN / --- PASS lines. Cosmetic.
Before fix output-

After fix-

• Pipeline build url:
  https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1182582&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

Peer-review analysis -

1. The golang version 1.26.5 vendors golang.org/x/net version 0.47 which is in affected range of < 0.56.0.
2. Affected file go/src/vendor/golang.org/x/net/dns/dnsmessage/svcb.go, function unpackSVCBResource() and affected code are present.
3. The patch completely matches with upstream patch except that the changes in file go/src/vendor/golang.org/x/net/dns/dnsmessage/message_test.go are not included as it does not exist in current source.
4. The patch has upstream reference.
5. The patch applies cleanly. (Checked .rpm.log)
6. The latest Buddy Build has passed.

Verdict - LGTM.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Kanishk Bansal (Kanishk-Bansal)]

will be covered in #18437