PatchFirst · Latest vulnerabilities
Vulnerabilities published for go1.26 in the last 30 days: 2. Listed in the KEV catalogue: 0.
Vulnerabilities: 8
This update for go1.26 fixes the following issues: Update to go 1.26.10 (bsc#1255111): - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772). - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).
This update for go1.26 fixes the following issues: Update to go 1.26.9 (bsc#1255111): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767). - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768). - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769). - CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771). - CVE-2026-94439: net/http: HTTP/1 server connection desynchro
This update for go1.26 fixes the following issues: Update to go1.26.6 (released 2026-08-13, bsc#1255111). Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures (bsc#1275034). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266609). - CVE-2026-56853: net/http: missing timeout when doing unencrypted HTTP/2 check can lead to a denial of service (bsc#1275028). - CVE-2026-56858: html/template: improper Javascript regexp context t
This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: * Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install of a working go command. Refs boo#1245878 bsc#1264395 * Based on feedback from Factory maintainers restore the original lifecycle for these files: Each go1.x toolchain shares ownership of a go and gofmt symlink managed by the alternatives system (update-alternatives and libalternatives).
This update for go1.26 fixes the following issues - Update to version go1.26.5 (bsc#1255111). - CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014). - CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
This update for go1.26 fixes the following issues Update to go1.26.4 (bsc#1255111): - CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450). - CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442). - CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444). Changes: * go#79230 go#79217 boo#1267442 security: fix CVE-2026-42504 mime: quadratic complexity in WordDecoder.DecodeHeader * go#79426 go#79346 boo#1267444 security: fix CVE-2026-42507 net/textproto: arbitrary input are included in errors without any escaping * go#79701 go#7969
This update for go1.26 fixes the following issues: - Update to version go1.26.2 (bsc#1255111). - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653). - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654). - CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655). - CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656). - CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657). - CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658). - CVE-2026-3228
This update for go1.26 fixes the following issues: Changes in go1.26: go1.26.1 (released 2026-03-05) includes security fixes to the crypto/x509, html/template, net/url, and os packages, as well as bug fixes to the go command, the go fix command, the compiler, and the os and reflect packages. ( boo#1255111) CVE-2026-25679 CVE-2026-27142 CVE-2026-27137 CVE-2026-27138 CVE-2026-27139 * go#77970 go#77578 boo#1259264 security: fix CVE-2026-25679 net/url: reject IPv6 literal not at start of host * go#77972 go#77954 boo#1259265 security: fix CVE-2026-27142 html/template: URLs in meta content attribute actions are not escaped * go#77973 g
Check your installed stack and versions against the current vulnerability feeds.