{"id":"CVE-2026-56857","aliases":["ALPINE-CVE-2026-56857","AZL-107457","AZL-107489","BELL-CVE-2026-56857","BIT-golang-2026-56857","EUVD-2026-95420","GHSA-c3q7-m35p-9qq7","GO-2026-6604","SUSE-SU-2026:24237-1","SUSE-SU-2026:24239-1","SUSE-SU-2026:4625-1","SUSE-SU-2026:4629-1","SUSE-SU-2026:4866-1","SUSE-SU-2026:4867-1","UBUNTU-CVE-2026-56857","openSUSE-SU-2026:12093-1","openSUSE-SU-2026:12101-1","openSUSE-SU-2026:12112-1","openSUSE-SU-2026:12351-1","openSUSE-SU-2026:22093-1","openSUSE-SU-2026:22095-1"],"status":"published","title":"Root.Mkdir(All) can follow junctions out of the root on Windows in os","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00553,"percentile":0.46669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1386"],"published":"2026-10-08T22:31:09Z","modified":"2026-11-04T20:04:20Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["29.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tempo-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13}],"products":[{"vendor":"go standard library","product":"internal/syscall/windows"},{"vendor":"go standard library","product":"os"}],"references":[{"url":"https://go.dev/cl/847305","tags":["web","fix"]},{"url":"https://go.dev/issue/81739","tags":["web","report"]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6604","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c3q7-m35p-9qq7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56857","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56857","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624237-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272545","tags":["report"]},{"url":"https://bugzilla.suse.com/1284766","tags":["report"]},{"url":"https://bugzilla.suse.com/1284767","tags":["report"]},{"url":"https://bugzilla.suse.com/1284768","tags":["report"]},{"url":"https://bugzilla.suse.com/1284769","tags":["report"]},{"url":"https://bugzilla.suse.com/1284770","tags":["report"]},{"url":"https://bugzilla.suse.com/1284771","tags":["report"]},{"url":"https://bugzilla.suse.com/1284772","tags":["report"]},{"url":"https://bugzilla.suse.com/1284773","tags":["report"]},{"url":"https://bugzilla.suse.com/1284774","tags":["report"]},{"url":"https://bugzilla.suse.com/1284775","tags":["report"]},{"url":"https://bugzilla.suse.com/1284776","tags":["report"]},{"url":"https://bugzilla.suse.com/1284777","tags":["report"]},{"url":"https://bugzilla.suse.com/1284778","tags":["report"]},{"url":"https://bugzilla.suse.com/1284779","tags":["report"]},{"url":"https://bugzilla.suse.com/1284780","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624239-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255111","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264625-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264629-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264866-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264867-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56857","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/08/9","tags":["report"]},{"url":"https://github.com/golang/go/issues/81739","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-56857","title":"Root.Mkdir(All) can follow junctions out of the root on Windows in os","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T22:53:58.387Z","modified":"2026-10-09T15:36:01.712Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1386"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-95420","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T22:53:58Z","modified":"2026-10-09T15:36:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:25.010362Z"}],"ghsa":[{"id":"GHSA-c3q7-m35p-9qq7","title":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty...","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-09T00:31:47Z","modified":"2026-10-09T18:31:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1386"],"updated_at":"2026-11-02T15:13:01.290603Z"}],"nvd":[{"id":"CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T23:17:01.487Z","modified":"2026-10-09T16:35:35.9Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1386"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"ALPINE-CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T23:17:01.487Z","modified":"2026-11-03T06:33:06.351557977Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-56857","title":"CVE-2026-56857 does not affect BellSoft software","status":"withdrawn","published":"2026-10-09T06:05:29.82592Z","modified":"2026-10-21T07:15:04.327927511Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"UBUNTU-CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T23:17:00Z","modified":"2026-11-04T20:04:20.117538227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T21:43:41.994988Z"},{"id":"AZL-107457","title":"CVE-2026-56857 affecting package golang 1.26.7-1","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T23:17:01Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107489","title":"CVE-2026-56857 affecting package golang 1.27.1-1","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T23:17:01Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"BIT-golang-2026-56857","title":"Root.Mkdir(All) can follow junctions out of the root on Windows in os","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-16T08:39:49.973Z","modified":"2026-10-16T09:55:42.27591222Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2026-6604","title":"Root.Mkdir(All) can follow junctions out of the root on Windows in os","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","status":"published","published":"2026-10-08T22:31:09Z","modified":"2026-10-16T09:55:42.27591222Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:12093-1","title":"go1.26-1.26.9-1.1 on GA media","description":"These are all security issues fixed in the go1.26-1.26.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-09T00:00:00Z","modified":"2026-10-10T17:23:22.436651438Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12101-1","title":"go1.27-1.27.2-1.1 on GA media","description":"These are all security issues fixed in the go1.27-1.27.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.867263309Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12112-1","title":"rclone-1.75.2-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-13T10:30:04.88132213Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12351-1","title":"tempo-cli-3.1.1-1.1 on GA media","description":"These are all security issues fixed in the tempo-cli-3.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:06.880197715Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:22093-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:02:27Z","modified":"2026-10-19T17:23:13.686380094Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22095-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:18:05Z","modified":"2026-10-19T17:23:13.634582243Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24237-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:03:33Z","modified":"2026-10-21T17:23:11.742264883Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24239-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:22:17Z","modified":"2026-10-21T17:23:11.945901699Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4625-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T08:25:05Z","modified":"2026-10-13T10:30:05.897991531Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4629-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T15:15:26Z","modified":"2026-10-13T10:30:05.951862663Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4866-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T14:38:04Z","modified":"2026-10-23T10:30:03.801269439Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4867-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T15:06:56Z","modified":"2026-10-23T10:30:04.00006771Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}