Repository navigation
chore(deps): update go toolchain directive to v1.26.9 [security] - #150
Open
felix-renovate[bot] wants to merge 1 commit into
Open
felix-renovate[bot] wants to merge 1 commit into
felix-renovate[bot] wants to merge 1 commit into
Conversation
felix-renovate
Bot
changed the title
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
from
July 14, 2026 20:07
85e1fd8 to
c517a4c
Compare
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
2 times, most recently
from
August 7, 2026 15:16
387eed8 to
28c7938
Compare
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
from
August 21, 2026 23:34
28c7938 to
b70fcb9
Compare
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
from
August 30, 2026 03:39
b70fcb9 to
cf83939
Compare
felix-renovate
Bot
changed the title
felix-renovate
Bot
changed the title
felix-renovate
Bot
deleted the
renovate/golang-version-go-vulnerability
branch
September 17, 2026 18:44
felix-renovate
Bot
changed the title
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
2 times, most recently
from
September 18, 2026 18:32
cf83939 to
53cea05
Compare
felix-renovate
Bot
force-pushed
the
renovate/golang-version-go-vulnerability
branch
from
October 9, 2026 15:43
53cea05 to
b9cb802
Compare
felix-renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.25.10→1.26.9Inefficient candidate hostname parsing in crypto/x509
BIT-golang-2026-27145 / CVE-2026-27145 / GO-2026-5037
More information
Details
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Quadratic complexity in WordDecoder.DecodeHeader in mime
BIT-golang-2026-42504 / CVE-2026-42504 / GO-2026-5038
More information
Details
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Arbitrary inputs are included in errors without any escaping in net/textproto
BIT-golang-2026-42507 / CVE-2026-42507 / GO-2026-5039
More information
Details
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Root escape via symlink plus trailing slash in os
BIT-golang-2026-39822 / CVE-2026-39822 / GO-2026-4970
More information
Details
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.
For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Invoking Encrypted Client Hello privacy leak in crypto/tls
BIT-golang-2026-42505 / CVE-2026-42505 / GO-2026-5856
More information
Details
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
CVE-2026-39821 / GO-2026-5026
More information
Details
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.
This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Enforce maximum recursion depth in encoding/asn1
BIT-golang-2026-33818 / CVE-2026-33818 / GO-2026-5972
More information
Details
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Add recursion depth guard during decode in encoding/xml
BIT-golang-2026-56859 / CVE-2026-56859 / GO-2026-6088
More information
Details
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
BIT-golang-2026-56853 / CVE-2026-56853 / GO-2026-6089
More information
Details
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Limit handshake messages we are willing to accept post-handshake in crypto/tls
BIT-golang-2026-56862 / CVE-2026-56862 / GO-2026-6090
More information
Details
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Fix Javascript regexp context tracking in html/template
BIT-golang-2026-56858 / CVE-2026-56858 / GO-2026-6091
More information
Details
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Avoid quadratic complexity in resolvePath in net/url
BIT-golang-2026-56860 / CVE-2026-56860 / GO-2026-6218
More information
Details
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Reset context tracking on consecutive template expressions in html/template
CVE-2026-94448 / GO-2026-6599
More information
Details
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Recognize yield as regexp preceder keyword in html/template
CVE-2026-97030 / GO-2026-6600
More information
Details
A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.
We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HTTP/2 server memory exhaustion due to Trailer headers in net/http
CVE-2026-78659 / GO-2026-6603
More information
Details
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Root.Mkdir(All) can follow junctions out of the root on Windows in os
CVE-2026-56857 / GO-2026-6604
More information
Details
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
CVE-2026-56866 / GO-2026-6605
More information
Details
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Reject malformed ECH outer extension references in crypto/tls
CVE-2026-97031 / GO-2026-6607
More information
Details
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
We now reject these as malformed and curb the memory amplification vector as a result.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
CVE-2026-94440 / GO-2026-6608
More information
Details
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Lack of limit on size of parsed Range headers in net/http
CVE-2026-78667 / GO-2026-6609
More information
Details
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HTTP/2 transport accepts malformed framing-related headers in net/http
CVE-2026-78660 / GO-2026-6610
More information
Details
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Excessive CPU consumption from repeated initial window changes in net/http
CVE-2026-78669 / GO-2026-6611
More information
Details
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Double flow control refund on HTTP/2 server streams in net/http
CVE-2026-78663 / GO-2026-6612
More information
Details
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
CVE-2026-94439 / GO-2026-6613
More information
Details
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.
The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HTTP/2 server crash due to HPACK encoder race in net/http
CVE-2026-97032 / GO-2026-6617
More information
Details
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.