{"id":"CVE-2026-94447","aliases":["ALPINE-CVE-2026-94447","ALSA-2026:86093","ALSA-2026:86196","ALSA-2026:86203","AZL-107454","AZL-107483","BELL-CVE-2026-94447","BIT-golang-2026-94447","DEBIAN-CVE-2026-94447","EUVD-2026-95418","GHSA-cgx4-3g64-rvr7","GO-2026-6602","MGASA-2026-0497","MGASA-2026-0586","RHSA-2026:79715","RHSA-2026:79720","SUSE-SU-2026:24237-1","SUSE-SU-2026:24239-1","SUSE-SU-2026:4625-1","SUSE-SU-2026:4629-1","SUSE-SU-2026:4866-1","SUSE-SU-2026:4867-1","UBUNTU-CVE-2026-94447","openSUSE-SU-2026:12093-1","openSUSE-SU-2026:12101-1","openSUSE-SU-2026:12112-1","openSUSE-SU-2026:22093-1","openSUSE-SU-2026:22095-1"],"status":"published","title":"Checksum database bypass for golang.org/toolchain in cmd/go","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00102,"percentile":0.00938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-354"],"published":"2026-10-08T22:31:09Z","modified":"2026-11-10T16:45:03Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"go","fixed_in":["1.26.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"go","fixed_in":["1.27.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.26","fixed_in":["1.26.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-1.27","fixed_in":["1.27.2-1"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.26.9","1.27.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:10","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el10_2.alma.1"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:9","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.el9_8"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-1.module_el8.10.0+4307+6e4cbc60"}]}],"bundled":15},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.10-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.7-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.24.3-r0"},{"fixed":"1.26.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-r2"},{"fixed":"1.27.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-1.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.10-1","1.19.10-2","1.19.11-1","1.19.12-1","1.19.12-2","1.19.12-2~bpo11+1","1.19.12-2~bpo12+1","1.19.13-1","1.19.13-1~bpo11+1","1.19.13-1~bpo12+1","1.19.8-2","1.19.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.12-1","1.24.13-1","1.24.13-2","1.24.4-1","1.24.4-2","1.24.4-3","1.24.4-4","1.24.7-1","1.24.8-1","1.24.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1"}]}],"versions":["1.26.0-1","1.26.1-1","1.26.2-1","1.26.2-2","1.26.2-3","1.26.3-1","1.26.3-1~bpo13+1","1.26.3-2","1.26.3-2~bpo13+1","1.26.4-1","1.26.4-1~bpo13+1","1.26.5-1","1.26.5-1~bpo13+1","1.26.6-1","1.26.6-2","1.26.7-1","1.26.7-1~bpo13+1","1.26.8-1","1.26.8-1~bpo13+1","1.26.8-2","1.26~rc2-1","1.26~rc3-1","1.26~rc3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1"}]}],"versions":["1.27.0-1","1.27.0-1~bpo13+1","1.27.1-1","1.27.1-2","1.27.1-2~bpo13+1","1.27.2-1~bpo13+1","1.27~rc1-1","1.27~rc2-1","1.27~rc3-1"]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-2.mga10"}]}],"bundled":41},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.27-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-0.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"golang1.26-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.9-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-150000.1.12.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-150000.1.33.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150600.13.18.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"go1.26-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.10-150000.1.21.2"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~16.04.2","1.13.8-1ubuntu1~16.04.3","1.13.8-1ubuntu1~16.04.3+esm2","1.13.8-1ubuntu1~16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~16.04.6","1.18.1-1ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu1~18.04.2","1.13.8-1ubuntu1~18.04.3","1.13.8-1ubuntu1~18.04.4","1.13.8-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~18.04.3","1.18.1-1ubuntu1~18.04.4","1.18.1-1ubuntu1~18.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.1-1ubuntu1","1.13.3-1ubuntu1","1.13.4-1ubuntu1","1.13.5-1ubuntu1","1.13.6-1ubuntu1","1.13.6-2ubuntu1","1.13.7-1ubuntu1","1.13.8-1ubuntu1","1.13.8-1ubuntu1.1","1.13.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14~beta1-1","1.14~beta1-2","1.14~rc1-1","1.14-1","1.14.1-1","1.14.2-1","1.14.2-1ubuntu1","1.14.3-2ubuntu2~20.04.1","1.14.3-2ubuntu2~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.1-1ubuntu1~20.04.1","1.18.1-1ubuntu1~20.04.2","1.18.1-1ubuntu1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~20.04","1.20.3-1ubuntu0.1~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu20.04.1","1.21.1-1~ubuntu20.04.2","1.21.1-1~ubuntu20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2","1.22.2-2~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18~beta1-0ubuntu1","1.18~beta2-1ubuntu1","1.18~beta2-1ubuntu2","1.18~rc1-1ubuntu1","1.18-1ubuntu1","1.18.1-1ubuntu1","1.18.1-1ubuntu1.1","1.18.1-1ubuntu1.2","1.18.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3-1ubuntu0.1~22.04","1.20.3-1ubuntu0.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1~ubuntu22.04.1","1.21.1-1~ubuntu22.04.2","1.21.1-1~ubuntu22.04.3","1.21.1-1~ubuntu22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3","1.22.2-2~22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~22.04","1.23.1-1~22.04.2","1.23.1-1~22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~22.04.1","1.24.4-1ubuntu1~22.04.2","1.24.13-2~22.04.1","1.24.13-2~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-1.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.8-1ubuntu2","1.13.8-1ubuntu2.22.04.1","1.13.8-1ubuntu2.22.04.1+esm1","1.13.8-1ubuntu2.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.1-1","1.21.3-1","1.21.4-1","1.21.5-1","1.21.6-1","1.21.7-1","1.21.7-2","1.21.8-1","1.21.8-1build1","1.21.9-1","1.21.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4","1.22.2-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.1-1~24.04","1.23.1-1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1~24.04.1","1.24.4-1ubuntu1~24.04.2","1.24.13-2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.14-1~ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.8-1~ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-1","1.26.2-3","1.26.4-1","1.26.5-1","1.26.6-2","1.26.7-1","1.26.8-1","1.26.8-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27~rc1-1","1.27~rc2-1","1.27~rc3-1","1.27.0-1","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.4-1ubuntu1","1.24.9-1","1.24.13-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-0ubuntu1","1.25.7-2","1.25.14-1~ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26~rc3-2","1.26.0-1","1.26.8-1~ubuntu0.26.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.2-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"go1.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.9-160000.1.1"}]}],"bundled":13}],"products":[{"vendor":"go toolchain","product":"cmd/go"}],"references":[{"url":"https://go.dev/cl/840785","tags":["web","fix","article"]},{"url":"https://go.dev/issue/81834","tags":["web","report","article"]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":["web","article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6602","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94447","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cgx4-3g64-rvr7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-94447","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86093","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78667","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97031","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548336","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548344","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556068","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86093.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-56866.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78659.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78660.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-78663.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94439.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94440.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94444.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94447.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-94448.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97030.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-97032.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86196","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86196.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86203","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-86203.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-94447","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94447","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0497.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36481","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/08/9","tags":["web","report"]},{"url":"https://advisories.mageia.org/MGASA-2026-0586.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35806","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-75-2-2026-10-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-1-2026-09-04","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-75-0-2026-07-31","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-74-4-2026-07-08","tags":["web"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["advisory"]},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79715","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94447","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94444","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79715.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94444","tags":["advisory"]},{"url":"https://go.dev/cl/840685","tags":["article"]},{"url":"https://go.dev/issue/81833","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6601","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94447","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79720","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79720.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624237-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272545","tags":["report"]},{"url":"https://bugzilla.suse.com/1284766","tags":["report"]},{"url":"https://bugzilla.suse.com/1284767","tags":["report"]},{"url":"https://bugzilla.suse.com/1284768","tags":["report"]},{"url":"https://bugzilla.suse.com/1284769","tags":["report"]},{"url":"https://bugzilla.suse.com/1284770","tags":["report"]},{"url":"https://bugzilla.suse.com/1284771","tags":["report"]},{"url":"https://bugzilla.suse.com/1284772","tags":["report"]},{"url":"https://bugzilla.suse.com/1284773","tags":["report"]},{"url":"https://bugzilla.suse.com/1284774","tags":["report"]},{"url":"https://bugzilla.suse.com/1284775","tags":["report"]},{"url":"https://bugzilla.suse.com/1284776","tags":["report"]},{"url":"https://bugzilla.suse.com/1284777","tags":["report"]},{"url":"https://bugzilla.suse.com/1284778","tags":["report"]},{"url":"https://bugzilla.suse.com/1284779","tags":["report"]},{"url":"https://bugzilla.suse.com/1284780","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624239-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255111","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264625-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264629-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264866-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286317","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264867-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94447","tags":["report"]},{"url":"https://github.com/golang/go/issues/81834","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-94447","title":"Checksum database bypass for golang.org/toolchain in cmd/go","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T22:53:57.974Z","modified":"2026-10-15T15:42:37.164Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-95418","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T22:53:57Z","modified":"2026-10-15T15:42:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:13.422137Z"}],"ghsa":[{"id":"GHSA-cgx4-3g64-rvr7","title":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org...","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-09T00:31:48Z","modified":"2026-10-15T18:32:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T15:13:37.004212Z"}],"nvd":[{"id":"CVE-2026-94447","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:05.18Z","modified":"2026-10-15T16:18:24.17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-354"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"ALPINE-CVE-2026-94447","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:05.18Z","modified":"2026-11-03T06:33:06.556404139Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-94447","status":"published","published":"2026-10-10T06:05:11.765777Z","modified":"2026-10-21T07:15:09.7230092Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-94447","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:05.18Z","modified":"2026-10-16T10:02:18.100949559Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"RHSA-2026:79715","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-10T10:22:52Z","modified":"2026-10-16T10:26:19Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:79720","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-10T10:22:53Z","modified":"2026-10-17T10:20:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-94447","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:00Z","modified":"2026-11-06T13:54:56.965378579Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T14:26:09.082677Z"},{"id":"ALSA-2026:86093","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:19.545498615Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86196","title":"Important: golang security, bug fix, and enhancement update","description":"The golang packages provide the Go programming language compiler.  \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:42:24.624651287Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86203","title":"Important: go-toolset:rhel8 security, bug fix, and enhancement update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.   \n\nSecurity Fix(es):  \n\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:12:06.542723063Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-107454","title":"CVE-2026-94447 affecting package golang 1.26.10-1","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107483","title":"CVE-2026-94447 affecting package golang 1.27.3-1","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T23:17:05Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"BIT-golang-2026-94447","title":"Checksum database bypass for golang.org/toolchain in cmd/go","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-16T08:40:11.458Z","modified":"2026-10-16T09:55:44.518918993Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2026-6602","title":"Checksum database bypass for golang.org/toolchain in cmd/go","description":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.\n\nWe now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","status":"published","published":"2026-10-08T22:31:09Z","modified":"2026-10-16T09:55:44.518918993Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"MGASA-2026-0497","title":"Updated golang packages fix security vulnerabilities","description":"net/http: HTTP/2 server crash due to HPACK encoder race\nnet/http: HTTP/2 server memory exhaustion due to Trailer headers\ncrypto/tls: reject malformed ECH outer extension references\ncmd/go: checksum bypass for golang.org/fips140\ncmd/go: checksum database bypass for golang.org/toolchain\nhtml/template: reset context tracking on consecutive template\nexpressions\nhtml/template: recognize |yield| as regexp preceder keyword\nnet/textproto, mime/multipart: memory limit bypass when parsing MIME\nheaders\nnet/http: HTTP/1 client connection desynchronization after CONNECT\nrejection\nnet/http: HTTP/1 server connection desynchronization after 2xx CONNECT\nresponse\nnet/http: excessive CPU consumption from repeated initial window changes\nnet/http: HTTP/2 transport accepts malformed framing-related headers\nnet/http: lack of limit on size of parsed Range headers\nnet/http: double flow control refund on HTTP/2 server streams\n","status":"published","published":"2026-10-13T01:20:53Z","modified":"2026-10-13T01:42:53.609450881Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0586","title":"Updated rclone package fixes security vulnerabilities","description":"This update brings new features, bugs and vulnerabilities fixed in the\nrclone and golang components used to build it.\n","status":"published","published":"2026-11-10T16:31:41Z","modified":"2026-11-10T16:45:03.103329652Z","updated_at":"2026-11-10T17:04:13.670671Z"},{"id":"openSUSE-SU-2026:12093-1","title":"go1.26-1.26.9-1.1 on GA media","description":"These are all security issues fixed in the go1.26-1.26.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-09T00:00:00Z","modified":"2026-10-10T17:23:22.436651438Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12101-1","title":"go1.27-1.27.2-1.1 on GA media","description":"These are all security issues fixed in the go1.27-1.27.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.867263309Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12112-1","title":"rclone-1.75.2-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.75.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-13T10:30:04.88132213Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22093-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:02:27Z","modified":"2026-10-19T17:23:13.686380094Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22095-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:18:05Z","modified":"2026-10-19T17:23:13.634582243Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24237-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T12:03:33Z","modified":"2026-10-21T17:23:11.742264883Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24239-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-13T15:22:17Z","modified":"2026-10-21T17:23:11.945901699Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4625-1","title":"Security update for go1.27","description":"This update for go1.27 fixes the following issues:\n\nUpdate to go1.27.2 (bsc#1272545):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.27.2 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, the cover tool, the go fix\n command, vet, and the compress/flate, crypto/mlkem,\n encoding/json, encoding/json/v2, net/http, and os packages.\n * go#81084 encoding/json: Unmarshal leaves +/-Inf in the destination on float overflow in Go 1.27\n * go#81145 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81226 runtime: netpoll: eventfd ready for something unexpected\n * go#81229 encoding/json: json.UnsupportedValueError returns an Invalid Value instead of a Float value\n * go#81233 compress/flate: Writer with a preset dictionary emits the dictionary into the output stream\n * go#81252 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81296 cmd/compile: internal compiler error: MoveLoop too small\n * go#81306 cmd/compile: go1.27.0 unified export data loses method order, breaking objectpath, crashing staticcheck\n * go#81324 plugin: loading multiple plugins corrupts stdlib types in Go 1.27\n * go#81353 runtime: Go 1.27.0: SIGSEGV crash with generic function + pointer type parameter + embedded interface\n * go#81362 encoding/json: Marshal now honors MarshalText for string-kind map keys\n * go#81374 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81389 cmd/fix, x/tools/go/analysis/passes/modernize: errorsastype rewrites errors.As target interface that does not implement error\n * go#81402 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81411 net/http: concurrent response body Read and Close can deadlock with automatic draining in Go 1.27\n * go#81437 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81469 runtime: ios/arm64 binaries executed outside an app bundle change working directory on startup\n * go#81515 net/http: readLoop reads Response.ContentLength after Body.Close returns\n * go#81516 net/http: Response.Body.Close returns the earlier Read error after a non-EOF Read failure\n * go#81522 net/http: Response.Trailer race due to response body draining\n * go#81580 testing: go test -v doubles ESC (0x1b) in t.Log output since Go 1.27, corrupting ANSI colors in some terminals\n * go#81666 cmd/compile: Embedded interfaces using tail calls cause race detector stack growth\n * go#81667 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81706 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered)\n * go#81816 net/http: Request.TLS is not properly populated for HTTP/2 requests\n * go#81818 cmd/internal/obj/ppc64: async preemption bug in BR (CTR)\n * go#81829 runtime: windows/amd64 stack corruption when LockOSThread wraps registry calls (new in Go 1.27)\n * go#81832 cmd/cover: NumStmt duplicated across split blocks, inflating statement coverage\n * go#81861 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81890 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T08:25:05Z","modified":"2026-10-13T10:30:05.897991531Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4629-1","title":"Security update for go1.26","description":"This update for go1.26 fixes the following issues:\n\nUpdate to go 1.26.9 (bsc#1255111):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n\nChanges:\n\n- go1.26.9 (released 2026-10-08) includes security fixes to the go\n command, and the crypto/tls, html/template, net/http,\n net/textproto, and os packages, as well as bug fixes to the\n compiler, the linker, the runtime, vet, and the crypto/mlkem,\n net/http, and os packages.\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining DWARF\n","status":"published","published":"2026-10-12T15:15:26Z","modified":"2026-10-13T10:30:05.951862663Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4866-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T14:38:04Z","modified":"2026-10-23T10:30:03.801269439Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4867-1","title":"Security update for go1.26-openssl","description":"This update for go1.26-openssl fixes the following issues:\n\nUpdate to version 1.26.10 (bsc#1255111, jsc#SLE-18320):\n\n- CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766).\n- CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767).\n- CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768).\n- CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769).\n- CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770).\n- CVE-2026-78667: net/http: lack of limit on size of parsed Range headers (bsc#1284771).\n- CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772).\n- CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response (bsc#1284773).\n- CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers (bsc#1284774).\n- CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 (bsc#1284775).\n- CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain (bsc#1284776).\n- CVE-2026-94448: html/template: reset context tracking on consecutive template expressions (bsc#1284777).\n- CVE-2026-97030: html/template: recognize yield as regexp preceder keyword (bsc#1284778).\n- CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references (bsc#1284779).\n- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race (bsc#1284780).\n- CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317,\n  bsc#1286261).\n\nChanges:\n\n * go#81144 runtime: mutex profiling can deadlock Windows asynchronous preemption during GC\n * go#81225 runtime: netpoll: eventfd ready for something unexpected\n * go#81251 lib/fips140: fix ML-KEM CAST and re-seal v1.26.0\n * go#81295 cmd/compile: internal compiler error: MoveLoop too small\n * go#81318 os,internal/poll: NewFile on an inherited overlapped stdout pipe hangs a sibling's WriteFile (Windows)\n * go#81401 os: go 1.25.x regression on RemoveAll for oldest Windows 10 build 10240\n * go#81436 runtime: intermittent SIGBUS (unaligned access) in netpoll on mips64le (Go 1.27)\n * go#81668 cmd/compile: go1.27 miscompiles \u0026slice[i].Field on an append-built slice; returned pointer aliases \n   reused memory\n * go#81689 cmd/compile: slice allocation reuses stack backing store incorrectly\n * go#81860 cmd/go: vet reports no diagnostics for a package that an earlier run vetted as a dependency\n * go#81889 cmd/link: plugin.Open fails on macOS 27: LC_DYLD_CHAINED_FIXUPS seg_count not updated after combining \n   DWARF\n * go#81152 cmd/compile/internal/test: TestMergeLocalsIntegration failures\n * go#81113 debug/elf: applyRelocationsPPC was broken by CL 705075\n * go#80889 os: TestRootMultiMkdirAllShallow failures on openbsd\n * go#80851 cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.26\n * go#80827 runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64\n","status":"published","published":"2026-10-22T15:06:56Z","modified":"2026-10-23T10:30:04.00006771Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}