Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
-------- Forwarded Message -------- Subject: [security] Go 1.27.4 and Go 1.26.11 are released Date: Tue, 10 Nov 2026 17:14:54 +0000 From: announce () golang org To: golang-nuts () googlegroups com
Hello gophers,
We have just released Go versions 1.27.4 and 1.26.11, minor point releases.
These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:
net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.
This is CVE-2026-97054 and Go issue <https://go.dev/issue/82563>.
cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives.
Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo.
"--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97033 and Go issue <https://go.dev/issue/82577>.
cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97034 and Go issue <https://go.dev/issue/82576>.
cmd/go: unexpected code execution and arbitrary file write via Clang -gen- and GCC -gnat flags in cgo
When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-/" or "-gnat/" flags in "#cgo" directives.
The "-g" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument "-gen-cdb-fragment-path " flag and GCC's two-argument "-gnatO " flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.
"-gen-/" and "-gnat/" flags are now disallowed in "#cgo" compiler and linker flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97035 and Go issue <https://go.dev/issue/82575>.
cmd/go: arbitrary code execution during build on darwin via "-l tolibrary" in cgo
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time.
The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Thanks to Ali Sherif (<https://www.linkedin.com/in/ali-sherif-13812b276/>) for reporting this issue.
This is CVE-2026-97036 and Go issue <https://go.dev/issue/82574>.
cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS".
Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.
The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97037 and Go issue <https://go.dev/issue/82573>.
cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.
Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LCLINKEROPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.
The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LCLINKEROPTION" load commands, or LTO IR sections, and disallows "-l:" and ":", "=", or path separators in "-l" flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97038 and Go issue <https://go.dev/issue/82572>.
cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.
The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97039 and Go issue <https://go.dev/issue/82571>.
cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files
Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking.
When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgoldflag" or "cgodynamiclinker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds.
The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Thanks to RyotaK (<https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97040 and Go issue <https://go.dev/issue/82570>.
cmd/compile, cmd/link: host linker flag injection via //go:cgo directives
Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.
The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments.
The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".
Thanks to RyotaK (<https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97041 and Go issue <https://go.dev/issue/82569>.
cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgoimportdynamic and PE DLL names
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.
The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk.
The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97042 and Go issue <https://go.dev/issue/82568>.
cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgoldflag
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives.
When "cmd/cgo" generates "cgogotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgoldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice.
"cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97043 and Go issue <https://go.dev/issue/82567>.
View the release notes for more information: https://go.dev/doc/devel/release#go1.27.4
You can download binary and source distributions from the Go website: https://go.dev/dl/
To compile from source using a Git clone, update to the release with |git checkout go1.27.4| and build as usual.
Thanks to everyone who contributed to the releases.
Cheers, Cherry and Junyang for the Go team
-- You received this message because you are subscribed to the Google Groups "golang-announce" group. To view this discussion visit https://groups.google.com/d/msgid/golang-announce/36b4ddac.BAAACcbRjpcAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBq81EO%40mailjet.com
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Checksum database bypass for golang.org/toolchain in cmd/go
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
-------- Forwarded Message -------- Subject: [security] Go 1.27.4 and Go 1.26.11 pre-announcement Date: Thu, 5 Nov 2026 22:10:14 +0000 From: announce () golang org To: golang-nuts () googlegroups com
Hello gophers,
CVE-2026-97033 CVE-2026-97034 CVE-2026-97035 CVE-2026-97036 CVE-2026-97037 CVE-2026-97038 CVE-2026-97039 CVE-2026-97040 CVE-2026-97041 CVE-2026-97042 CVE-2026-97043 CVE-2026-97054
Following our security policy, this is the pre-announcement of those releases.
Thanks, Michael and Cherry for the Go team
--
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.
In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
-------- Forwarded Message -------- Subject: [security] Go 1.27.2 and Go 1.26.9 are released Date: Thu, 8 Oct 2026 18:08:50 +0000 From: announce () golang org To: golang-nuts () googlegroups com
Hello gophers,
We have just released Go versions 1.27.2 and 1.26.9, minor point releases. net/http: HTTP/2 server crash due to HPACK encoder race
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGSHEADERTABLESIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Fix this issue by not applying SETTINGSHEADERTABLESIZE immediately. Instead, buffer any SETTINGSHEADERTABLESIZE received, and only apply the new value prior to the next time the server writes a frame.
Thanks to RyotaK (https://ryotak.net <https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97032 and Go issue https://go.dev/issue/81867 <https://go.dev/issue/81867>.
net/http: HTTP/2 server memory exhaustion due to Trailer headers
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits are now applied towards the trailer fields declared in "Trailer" headers.
Thanks to RyotaK (https://ryotak.net <https://ryotak.net>) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-78659 and Go issue https://go.dev/issue/81857 <https://go.dev/issue/81857>.
crypto/tls: reject malformed ECH outer extension references
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
We now reject these as malformed and curb the memory amplification vector as a result.
This is CVE-2026-97031 and Go issue https://go.dev/issue/81855 <https://go.dev/issue/81855>.
cmd/go: checksum bypass for golang.org/fips140
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.
We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
This is CVE-2026-94444 and Go issue https://go.dev/issue/81833 <https://go.dev/issue/81833>.
cmd/go: checksum database bypass for golang.org/toolchain
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.
We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
This is CVE-2026-94447 and Go issue https://go.dev/issue/81834 <https://go.dev/issue/81834>.
html/template: reset context tracking on consecutive template expressions
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
This is CVE-2026-94448 and Go issue https://go.dev/issue/81821 <https://go.dev/issue/81821>.
html/template: recognize |yield| as regexp preceder keyword
A trusted template author may have previously written a valid template wherein the use of the |yield| keyword would not be correctly escaped.
We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
This is CVE-2026-97030 and Go issue https://go.dev/issue/81823 <https://go.dev/issue/81823>.
net/textproto, mime/multipart: memory limit bypass when parsing MIME headers
Parsing a multipart form could bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part was less than 400 bytes.
Multipart form memory limits are now properly enforced in this situation.
Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.
This is CVE-2026-94440 and Go issue https://go.dev/issue/81741 <https://go.dev/issue/81741>.
net/http: HTTP/1 client connection desynchronization after CONNECT rejection
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
The HTTP/1 transport now closes a connection after sending a CONNECT request, regardless of the response status.
In addition, ReverseProxy now rejects incoming CONNECT requests with a 405 Method Not Allowed response. ReverseProxy has never handled CONNECT requests in a useful fashion (it does not convert the connection into a bidirectional tunnel), so we do not expect this change to negatively affect any current users.
Thanks to Xclow3n (Rajat Raghav) for reporting this issue.
This is CVE-2026-56866 and Go issue https://go.dev/issue/81740 <https://go.dev/issue/81740>.
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response
When an HTTP server handler sent a 2xx response to an HTTP/1 CONNECT request and returned without hijacking the connection, the server improperly continued to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
The HTTP/1 server now always closes a connection after responding to a CONNECT request, regardless of the response status.
Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.
This is CVE-2026-94439 and Go issue https://go.dev/issue/81744 <https://go.dev/issue/81744>.
net/http: excessive CPU consumption from repeated initial window changes
A malicious HTTP/2 peer could cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.
The HTTP/2 client and server now efficiently handle changes to the initial window size (O(1) rather than O(number of streams)).
Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.
This is CVE-2026-78669 and Go issue https://go.dev/issue/81742 <https://go.dev/issue/81742>.
net/http: HTTP/2 transport accepts malformed framing-related headers
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
We now delete malformed framing-related headers when received by our HTTP/2 transport, so they will not be forwarded to a potentially vulnerable HTTP/1 client.
Thanks to TJ Barton for reporting this issue.
This is CVE-2026-78660 and Go issue https://go.dev/issue/81115 <https://go.dev/issue/81115>.
os: Root.Mkdir(All) can follow junctions out of the root on Windows
On Windows, when the target of Root.Mkdir or Root.MkdirAll was a junction pointing to an empty location, the operation would create a directory at the junction target even when that target was located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Root.Mkdir and Root.MkdirAll now correctly avoid resolving junctions.
Thanks to Daniele Ballarini for reporting this issue.
This is CVE-2026-56857 and Go issue https://go.dev/issue/81739 <https://go.dev/issue/81739>.
net/http: lack of limit on size of parsed Range headers
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges= GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0 disables the limit.
Thanks to Jakub Ciolek (https://ciolek.dev <https://ciolek.dev>) for reporting this issue.
This is CVE-2026-78667 and Go issue https://go.dev/issue/81858 <https://go.dev/issue/81858>.
net/http: double flow control refund on HTTP/2 server streams
The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client could exploit this to bypass the configured connection-level limited by the concurrent stream limit and stream-level flow control.
The HTTP/2 server now waits to refund connection-level flow control for reset streams until after the request handler is complete.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/ <https://www.linkedin.com/in/ali-sherif-13812b276/>) for reporting this issue.
This is CVE-2026-78663 and Go issue https://go.dev/issue/81743 <https://go.dev/issue/81743>.
View the release notes for more information: https://go.dev/doc/devel/release#go1.27.2
You can download binary and source distributions from the Go website: https://go.dev/dl/
To compile from source using a Git clone, update to the release with |git checkout go1.27.2| and build as usual.
Thanks to everyone who contributed to the releases.
Cheers, Dmitri and Michael for the Go team
--
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Arbitrary code execution during build on Darwin in cmd/go
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
-------- Forwarded Message -------- Subject: [security] Go 1.26.5 and Go 1.25.12 are released Date: Tue, 7 Jul 2026 20:22:04 +0000 From: announce () golang org To: golang-nuts () googlegroups com
Hello gophers,
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy <https://go.dev/doc/security/policy>:
os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly followed symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.
For example, |root.Open("symlink/")| would open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
On Unix, |openat(fd, path, ONOFOLLOW)| will follow symlinks in |path| when |path| ends in a /. Root failed to account for this behavior, permitting paths with a trailing / to escape. It now properly sanitizes the path parameter provided to openat.
Thanks to Mundur <https://github.com/M0nd0R> forreporting this issue.
This is CVE-2026-39822 and Go issue <https://go.dev/issue/79005>.
crypto/tls: Encrypted Client Hello privacy leak
The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue <https://go.dev/issue/79282>.
View the release notes for more information: https://go.dev/doc/devel/release#go1.26.5
You can download binary and source distributions from the Go website: https://go.dev/dl/
To compile from source using a Git clone, update to the release with |git checkout go1.26.5| and build as usual.
Thanks to everyone who contributed to the releases.
Cheers, Junyang and David for the Go team
-- You received this message because you are subscribed to the Google Groups "golang-announce" group. To view this discussion visit https://groups.google.com/d/msgid/golang-announce/f9a3d5eb.CAAACOz5h5QAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBqTVs%40mailjet.com <https://groups.google.com/d/msgid/golang-announce/f9a3d5eb.CAAACOz5h5QAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBqTVs%40mailjet.com?utmmedium=email&utmsource=footer>.
-------- Forwarded Message -------- Subject: [security] Go 1.26.4 and Go 1.25.11 are released Date: Tue, 2 Jun 2026 21:11:30 +0000 From: announce () golang org To: golang-nuts () googlegroups com
Hello gophers,
We have just released Go versions 1.26.4 and 1.25.11, minor point releases.
These releases include 3 security fixes following the security policy <https://go.dev/doc/security/policy>:
mime: quadratic complexity in WordDecoder.DecodeHeader
Decoding a maliciously-crafted MIME header containing many invalid encoded-words could consume excessive CPU. The MIME decoder now better handles this case.
Thanks to p4p3r (<https://hackerone.com/p4p3rhak>) for reporting this issue.
This is CVE-2026-42504 and Go issue https://go.dev/issue/79217
net/textproto: arbitrary input are included in errors without any escaping
When returning errors, functions in the net/textproto package would include its input as part of the error, without any escaping. Note that said input is often controlled by external parties when using this package naturally. For example, a net/http client uses ReadMIMEHeader when parsing the headers it receive from a server.
As a result, an attacker could inject arbitrary content into the error. Practically, this can result in an attacker injecting misleading content, terminal control bytes, etc. into a victim's output or logs.
This is CVE-2026-42507 and Go issue https://go.dev/issue/79346
crypto/x509: split candidate hostname only once
(x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Thanks to Jakub Ciolek (<https://ciolek.dev>) for reporting this issue.
This is CVE-2026-27145 and https://go.dev/issue/79694
View the release notes for more information: https://go.dev/doc/devel/release#go1.26.4
You can download binary and source distributions from the Go website: https://go.dev/dl/
To compile from source using a Git clone, update to the release with |git checkout go1.26.4| and build as usual.
Thanks to everyone who contributed to the releases.
Cheers, The Go team
-- You received this message because you are subscribed to the Google Groups "golang-announce" group. To view this discussion visit https://groups.google.com/d/msgid/golang-announce/b412db1a.BAAACMDeKCEAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBqH0cC%40mailjet.com
On 4/21/26 07:36, Michael Orlitzky wrote: On 2026-04-20 13:10:13, Demi Marie Obenour wrote: I wonder if build infra needs to be updated to support automated rebuilds when a reverse dependency is updated. My understanding is that FreeBSD ports, Nix, and OBS already support this. On its own this isn't sufficient because many packages pin their dependencies to specific versions or git commits. This causes a cascade of problems:
Most dependencies can't be packaged separately, because eventually two applications will require two different versions of the same library, not to mention the labor involved. I believe Fedora manages to package multiple versions of Rust libraries without any problems. They don't ship them to users, though. You can try to loosen the dependency constraints yourself, but with everyone else bundling, no one cares about API/ABI stability and breakage is likely.
OTOH with dependencies left bundled and pinned to specific versions, rebuilding does nothing except change mtimes. At least Rust libraries generally do care about API stability. You're correct that nobody cares about ABI stability, but cascading rebuilds are exactly what that is meant to avoid. 'cargo install' doesn't use the lockfile by default, so problems with newer but semver-compatible dependency versions are likely to be caught.
I don't know if the Go ecosystem has the same problem. I know Maven does have that problem. -- Sincerely, Demi Marie Obenour (she/her/hers)
On 2026-04-20 13:10:13, Demi Marie Obenour wrote: I wonder if build infra needs to be updated to support automated rebuilds when a reverse dependency is updated. My understanding is that FreeBSD ports, Nix, and OBS already support this. On its own this isn't sufficient because many packages pin their dependencies to specific versions or git commits. This causes a cascade of problems:
Most dependencies can't be packaged separately, because eventually two applications will require two different versions of the same library, not to mention the labor involved.
You can try to loosen the dependency constraints yourself, but with everyone else bundling, no one cares about API/ABI stability and breakage is likely.
OTOH with dependencies left bundled and pinned to specific versions, rebuilding does nothing except change mtimes.