https://seclists.org/oss-sec/2026/q1/262: Go 1.26.1 and Go 1.25.8 aleased with 5 CVE fixes
Published Mar 6, 2026
·Updated
Affected Software
1 affected component
golang/go
Frequently Asked Questions
1
What security vulnerabilities are addressed in Go 1.26.1 and Go 1.25.8?
Go 1.26.1 and Go 1.25.8 address 5 security vulnerabilities including an issue with incorrect enforcement of email constraints in the crypto/x509 package.
2
What is the CVE ID for the crypto/x509 email constraint vulnerability in Go 1.26.1?
The specific CVE IDs for the vulnerabilities are not detailed in the announcement, but they are addressed in the provided release notes.
3
How do I upgrade to Go 1.26.1 or Go 1.25.8?
You can upgrade to Go 1.26.1 or Go 1.25.8 by downloading the latest version from the official Go website or using your package manager.
4
What are the risks of not updating to Go 1.26.1 or Go 1.25.8 with the CVE fixes?
Failure to update to Go 1.26.1 or Go 1.25.8 may leave applications vulnerable to exploitation of the addressed security flaws.
5
Is it safe to use older versions of Go after the release of 1.26.1 and 1.25.8?
Using older versions of Go that do not have the latest security fixes is not recommended due to potential security risks.