Go Updates & Release Notes

Hello gophers,

We have tagged version v0.40.0 of golang.org/x/mod in order to address the following security issues:

x/mod/sumdb/tlog: fix transparency log tile verification bypass

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to Filippo Valsorda (Geomys) for reporting this issue.

This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to mundur for reporting this issue.

This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

Cheers,
Go Security team

Hello gophers,

We have just released go1.27rc3, a release candidate version of Go 1.27.
It is cut from release-branch.go1.27 at the revision tagged go1.27rc3.

This release includes 10 security fixes following the security policy:

• x/mod/sumdb/tlog: fix transparency log tile verification bypass

A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

• x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.

This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.

In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

• encoding/xml: add recursion depth guard during decode

Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.

This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

• net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check

When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.

This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

• net/url: avoid quadratic complexity in resolvePath

Previously, resolving relative paths containing parent directory ( .. ) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.

• golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record

Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

• crypto/tls: limit handshake messages we are willing to accept post-handshake

Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.

Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

• html/template: fix Javascript regexp context tracking

Previously, pathological inputs could close an
unescaped / early, allowing for attack-controlled
data to inject arbitrary content, potentially
leading to XSS.

Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.

• x/net/idna: failure to reject ASCII-only Punycode-encoded labels

The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.

The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.

This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".

Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

• encoding/asn1: enforce maximum recursion depth

Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.

Thanks to Marwan Atia ([email protected]) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

Please try your production load tests and unit tests with the new version.

Your help testing these pre-release versions is invaluable.
Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to Go telemetry if you haven't already.
Go telemetry helps validate this release candidate and future Go releases.
You can opt in by running the following command:
$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc3
is by using the go command:
$ go install golang.org/dl/go1.27rc3@latest
$ go1.27rc3 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc3

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,
Dmitri and Mark for the Go team

Hello gophers,

We have just released Go versions 1.26.6 and 1.25.13, minor point releases.

These releases include 10 security fixes following the security policy:

• x/mod/sumdb/tlog: fix transparency log tile verification bypass

  A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:
  rm -r go.sum go.work.sum vendor/ && go mod tidy
  Thanks to Filippo Valsorda (Geomys) for reporting this issue.
  This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

• x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

  A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:
  rm -r go.sum go.work.sum vendor/ && go mod tidy
  Thanks to mundur for reporting this issue.
  This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

• encoding/xml: add recursion depth guard during decode

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
  This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

• net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check

  When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Previously, this was being done with no timeout applied. ReadHeaderTimeout is now applied for this.
  This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

• net/url: avoid quadratic complexity in resolvePath

  Previously, resolving relative paths containing parent directory (..) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
  This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.

• golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record

  Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
  This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

• crypto/tls: limit handshake messages we are willing to accept post-handshake

  Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
  Thanks to Qi Deng of Aurascape.ai for reporting this issue.
  This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

• html/template: fix Javascript regexp context tracking

  Previously, pathological inputs could close an unescaped / early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
  Thanks to Ali Sherif for reporting this issue.
  This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.

• x/net/idna: failure to reject ASCII-only Punycode-encoded labels

  The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returned the name "example.com" rather than an error. The idna package implements the processing algorithm from UTS 46. Older versions of UTS 46 included a specification bug which permitted multiple ASCII labels to decode to the same Unicode label. UTS 46 revision 33 fixed the specification bug. The idna package now implements the updated specification. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
  Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
  This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

• encoding/asn1: enforce maximum recursion depth

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
  Thanks to Marwan Atia ([email protected]) for reporting this issue.
  This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.6

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with

git checkout go1.26.6

and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Dmitri and Mark for the Go team

Hello gophers,

We have just released go1.27rc2, a release candidate version of Go 1.27.

It is cut from release-branch.go1.27 at the revision tagged go1.27rc2.

This release includes 2 security fixes following the security policy:

os: Root escape via symlink plus trailing slash

On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.

For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.

On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.

It now properly sanitizes the path parameter provided to openat.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

crypto/tls: Encrypted Client Hello privacy leak

The Encrypted Client Hello implementation would leak the pre-shared key
identities during the handshake, allowing a passive network observer who can
collect handshakes to de-anonymize the hostname of the server, even when ECH was
being used.

Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

Please try your production load tests and unit tests with the new version.

Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to Go telemetry if you haven't already.

Go telemetry helps validate this release candidate and future Go releases.

You can opt in by running the following command:

$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc2
is by using the go command:

$ go install golang.org/dl/go1.27rc2@latest
$ go1.27rc2 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc2

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,

Junyang and David for the Go team

Hello gophers,

We have just released Go versions 1.26.5 and 1.25.12, minor point releases.

These releases include 2 security fixes following the security policy:

• os: Root escape via symlink plus trailing slash

  On Unix systems, opening a file in an os.Root improperly followed symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

  For example, root.Open("symlink/") would open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

  On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks in path when path ends in a /. Root failed to account for this behavior, permitting paths with a trailing / to escape.

  It now properly sanitizes the path parameter provided to openat.

  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

  This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

• crypto/tls: Encrypted Client Hello privacy leak

  The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

  This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.5

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.26.5 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Junyang and David for the Go team

Hello gophers,

We have just released go1.27rc1, a release candidate version of Go 1.27.
It is cut from release-branch.go1.27 at the revision tagged go1.27rc1.
Please try your production load tests and unit tests with the new version.
Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to
Go telemetry
if you haven't already.
Go telemetry helps validate this release candidate and future Go releases.
You can opt in by running the following command:

$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc1
is by using the go command:

$ go install
golang.org/dl/go1.27rc1@latest
$ go1.27rc1 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc1

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,

Dmitri and Cherry for the Go team

Hello gophers,

We have just released Go versions 1.26.4 and 1.25.11, minor point releases.

These releases include 3 security fixes following the security policy:

• mime: quadratic complexity in WordDecoder.DecodeHeader
  Decoding a maliciously-crafted MIME header containing many invalid
  encoded-words could consume excessive CPU.
  The MIME decoder now better handles this case.
  Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
  This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.

• net/textproto: arbitrary input are included in errors without any escaping
  When returning errors, functions in the net/textproto package would
  include its input as part of the error, without any escaping. Note that
  said input is often controlled by external parties when using this
  package naturally. For example, a net/http client uses ReadMIMEHeader
  when parsing the headers it receive from a server.
  As a result, an attacker could inject arbitrary content into the error.
  Practically, this can result in an attacker injecting misleading
  content, terminal control bytes, etc. into a victim's output or logs.
  This is CVE-2026-42507 and Go issue https://go.dev/issue/79346

• crypto/x509: split candidate hostname only once
  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
  over all DNS Subject Alternative Name (SAN) entries. This caused
  strings.Split(host, ".") to execute repeatedly on the same input hostname.
  With a large DNS SAN list, verification costs scaled quadratically based on the
  number of SAN entries multiplied by the hostname's label count. Because
  x509.Verify validates hostnames before building the certificate chain, this
  overhead occurred even for untrusted certificates.
  Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
  This is CVE-2026-27145 and https://go.dev/issue/79694.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with

git checkout go1.26.4

and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,

The Go team

Ahoy gophers,

We have tagged version v0.52.0 of golang.org/x/crypto in order to address the following security issues:

ssh/agent: pathological inputs can lead to client panic

For certain crafted inputs, a ed25519.PrivateKey was created by casting malformed wire bytes, leading to a panic when used.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-46598 and Go issue https://go.dev/issue/79596.

ssh: byte arithmetic causes underflow and panic

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Thanks to Maciej Kawka for reporting this issue.

This is CVE-2026-46597 and Go issue https://go.dev/issue/79561.

ssh: bypass of certificate restrictions

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39828 and Go issue https://go.dev/issue/79562.

ssh: server panic during CheckHostKey/Authenticate

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39835 and Go issue https://go.dev/issue/79563.

ssh/agent: key constraints not enforced

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39833 and Go issue https://go.dev/issue/79436.

ssh/agent: agent constraints dropped when forwarding keys

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39832 and Go issue https://go.dev/issue/79435.

ssh: memory leak when rejecting channels can lead to DoS

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Thanks to Ziyan Zhou for reporting this issue.

This is CVE-2026-39827 and Go issue https://go.dev/issue/35127.

ssh: client can cause server deadlock on unexpected responses

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39830 and Go issue https://go.dev/issue/79564.

ssh: pathological RSA/DSA parameters may cause DoS

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39829 and Go issue https://go.dev/issue/79565.

ssh: bypass of FIDO/U2F security keys physical interaction

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39831 and Go issue https://go.dev/issue/79566.

ssh: infinite loop on large channel writes

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39834 and Go issue https://go.dev/issue/79567.

ssh/knownhosts: auth bypass via unenforced @revoked status

Previously, a revoked SignatureKey belonging to a CA was not correctly checked for revocation. Now, both the key and key.SignatureKey are checked for @revoked.

This is CVE-2026-42508 and Go issue https://go.dev/issue/79568.

ssh: VerifiedPublicKeyCallback permissions skip enforcement

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

This is CVE-2026-46595 and Go issue https://go.dev/issue/79570.

Cheers,

Go Security Team

Hello gophers,

We have tagged version v0.41.0 of golang.org/x/image in order to address the following security issues:

x/image/bmp: panic when reading out of bound palette index

Decoding a paletted BMP file with an out-of-range palette index would result in a panic when accessing pixels in the invalid image. Decoding now correctly returns an error in this case. This is CVE-2026-42500 and Go issue https://go.dev/issue/79576.

x/image/tiff: excessive resource consumption in PackBits decompression

The TIFF decoder did not place a limit on the size of PackBits-compressed data. A maliciously-crafted image could exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data. The decoder now limits the amount of PackBits-compressed data it will decompress. Thanks to Uuganbayar Lkhamsuren for reporting this issue. This is CVE-2026-33809 and Go issue https://go.dev/issue/79577.

Cheers,

Go Security team

Hello gophers,

We have tagged version v0.55.0 of golang.org/x/net in order to address the following security issues:

html: incorrect handling of namespaced elements in foreign content

The HTML parser mishandled certain namespaced elements in foreign content,
causing them to be incorrectly rendered. This can lead to XSS when rendering
parsed HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-42506 and Go issue https://go.dev/issue/79571.

x/net/idna: failure to reject ASCII-only Punycode-encoded labels

The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.

The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.

This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".

Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.

This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

html: incorrect handling of HTML elements in foreign content

The HTML parser mishandled certain HTML elements in foreign content, causing
them to be incorrectly rendered. This can lead to XSS when rendering parsed
HTML.

Thanks to Tristan Madani for reporting this issue.

This is CVE-2026-42502 and Go issue https://go.dev/issue/79572.

html: denial of service when parsing arbitrary HTML

Due to the use of a cubic complexity algorithm during the HTML tree construction
stage, parsing arbitrary HTML can consume excessive CPU time.

Thanks to IPC Labs for reporting this issue.

This is CVE-2026-25680 and Go issue https://go.dev/issue/79573.

html: incorrect handling of character references in DOCTYPE nodes

The HTML parser mishandled character references in DOCTYPE nodes, causing
them to be incorrectly rendered. This can lead to XSS when rendering parsed
HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-25681 and Go issue https://go.dev/issue/79574.

html: duplicate attributes can cause XSS

The HTML parser did not properly handle multiple duplicate attributes, causing
the parser to misparse certain HTML trees. This can cause XSS when rendering
parsed HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-27136 and Go issue https://go.dev/issue/79575.

Cheers,
Go Security team

Howdy gophers,

We have tagged version v0.45.0 of golang.org/x/sys in order to address a security issue.

windows: integer overflow in NewNTUnicodeString

NewNTUnicodeString did not check for string length overflow.
When provided with a string that overflows the maximum size of a
NTUnicodeString (a 16-bit number of bytes), it returned a truncated
string rather than an error.

It now correctly returns an error when provided with a too-long string.

This is CVE-2026-39824 and Go issue https://go.dev/issue/78916.

Cheers,

Go Security Team

Since its inception, pkg.go.dev has established itself as the Go community’s primary resource for package documentation and discovery. While we initially prioritized creating a comprehensive and highly accessible web interface for users, the need for programmatic access has become increasingly clear. Developers building tools, IDE integrations, and automated workflows have historically relied on fragile workarounds like web scraping to access this data. To better address these evolving requirements, we are now expanding our platform to provide robust, direct access to the information our community needs.

Today, we are excited to introduce the official pkg.go.dev API — a service interface for querying metadata about published Go modules. This launch is a direct response to years of community feedback. Furthermore, the need for a formalized interface has become even more acute with the rise of AI-assisted coding. Tools can now access the specific, high-fidelity context needed to reason about the Go ecosystem with greater precision.

The service interface

Built for stability and efficient caching, the API uses a stateless, GET-only architecture. Primary endpoints are currently hosted under the /v1beta path. Following a period of community feedback and confirmed stability, we intend to transition toward a formal v1 release.

For a complete interactive reference of all endpoints, query parameters, and response shapes, see the pkg.go.dev/api specification. The machine-readable API contract is also published directly as an OpenAPI specification.

Core endpoints

Endpoint | Description
/v1beta/package/{path} | Information about the package at {path}.
/v1beta/module/{path} | Information about the module at {path}.
/v1beta/versions/{path} | Versions of the module at {path}.
/v1beta/packages/{path} | Information about packages of the module at {path}.
/v1beta/search?q={query} | Search results for a given query.
/v1beta/symbols/{path} | List of symbols declared by the package at {path}.
/v1beta/imported-by/{path} | Paths of packages importing the package at {path}.
/v1beta/vulns/{path} | Vulnerabilities of the module or package at {path}.

One design principle for this API is “precision over convenience.” For context, when go mod tidy encounters an import of a package that isn’t provided by an existing dependency of the main module, it applies the “longest module path” rule to determine which module is needed. (The fact that two or more modules could provide the package is what makes it possible to later carve out a submodule without breaking existing programs.) The pkg.go.dev web interface follows a similar convention when choosing which package to display for a given package path. By contrast, the pkg.go.dev API requires the module to be specified unambiguously. If a package path is ambiguous because it exists in multiple modules, the API returns a list of candidates and reports an error asking the client to be more specific.

For example, a package imported as example.com/a/b/c could be provided by module example.com/a or by example.com/a/b. While the pkg.go.dev web interface will automatically resolve the “longest module path” (example.com/a/b), a client querying the API must specify the module explicitly to avoid an ambiguous resolution error.

Specifying versions

For endpoints that retrieve package, module, or symbol information, you can specify the desired version using the optional version query parameter. The API returns information about the latest version of the module or package by default. The parameter supports:

• Semantic Versions: Retrieve data for a specific release tag (e.g., ?version=v1.2.3 or ?version=v0.6.0).
• Branch Names: Reference default development branches—specifically master or main (e.g., ?version=master). The API will automatically resolve the branch to its corresponding pseudo-version. Note that custom or arbitrary branch names are not supported.

If the version parameter is omitted, the API defaults to resolving the request against the latest tagged version of the package or module.

Example: raw API request

To retrieve structured metadata for a specific package directly (using jq for formatting):

$ curl https://pkg.go.dev/v1beta/package/github.com/google/go-cmp/cmp | jq .
{
  "modulePath": "github.com/google/go-cmp",
  "version": "v0.7.0",
  "isLatest": true,
  "isStandardLibrary": false,
  "goos": "all",
  "goarch": "all",
  "path": "github.com/google/go-cmp/cmp",
  "name": "cmp",
  "synopsis": "Package cmp determines equality of values.",
  "isRedistributable": true
}

To query a specific branch version (like master) and see it resolve automatically to its corresponding pseudo-version:

$ curl -s "https://pkg.go.dev/v1beta/package/github.com/google/go-cmp/cmp?version=master" | jq '{path, version}'
{
  "path": "github.com/google/go-cmp/cmp",
  "version": "v0.7.1-0.20260310220054-34c9473539b8"
}

The pkgsite-cli reference implementation

To demonstrate how to interact with our API, we are providing a reference client implementation: pkgsite-cli. This implementation serves as a practical example for developers looking to build their own integrations, showing how to handle the data directly from the terminal. Please be aware that as the API continues to evolve, the interface and behavior of this command may change.

To get started, install the command:

$ go install golang.org/x/pkgsite/cmd/internal/pkgsite-cli@latest

To search for packages:

$ pkgsite-cli search "uuid"
github.com/google/uuid
  Module:   github.com/google/[email protected]
  Synopsis: Package uuid generates and inspects UUIDs.
... more

To inspect a specific package:

$ pkgsite-cli package github.com/google/go-cmp/cmp
github.com/google/go-cmp/cmp
  Name:      cmp
  Module:    github.com/google/go-cmp
  Version:   v0.7.0 (latest)
  Synopsis:  Package cmp determines equality of values.

To see which packages import a specific package:

$ pkgsite-cli package --imported-by github.com/google/go-cmp/cmp
github.com/google/go-cmp/cmp
  Name:     cmp
  Module:   github.com/google/go-cmp
  Version:  v0.7.0 (latest)
  Synopsis: Package cmp determines equality of values.

Imported by:
  cloud.google.com/go/internal/testutil
  cuelang.org/go/internal/cuetxtar
  chainguard.dev/apko/pkg/build/types
  ... more

To list symbols declared by a package:

$ pkgsite-cli package --symbols github.com/google/go-cmp/cmp
github.com/google/go-cmp/cmp
  Name:     cmp
  Module:   github.com/google/go-cmp
  Version:  v0.7.0 (latest)
  Synopsis: Package cmp determines equality of values.

Symbols:
  type Indirect struct{}
  type MapIndex struct{}
  type Option interface{}
  ... more

To list versions of a module:

$ pkgsite-cli module -versions github.com/google/go-cmp
github.com/google/go-cmp
  Version:          v0.7.0 (latest)
  Repository:       https://github.com/google/go-cmp
  Has go.mod:       yes
  Redistributable:  yes

Versions:
  v0.7.0
  v0.6.0
  v0.5.9
  ... more

To list both versions and packages of a module:

$ pkgsite-cli module -packages -versions github.com/google/go-cmp
github.com/google/go-cmp
  Version:          v0.7.0 (latest)
  Repository:       https://github.com/google/go-cmp
  Has go.mod:       yes
  Redistributable:  yes

Versions:
  v0.7.0
  v0.6.0
  v0.5.9
  ... more

Packages:
  github.com/google/go-cmp/cmp             Package cmp determines equality of values.
  github.com/google/go-cmp/cmp/cmpopts     Package cmpopts provides common options for the cmp package.
  ... more

The command handles pagination and formatting, allowing you to focus on the data you need for your scripts or manual investigation. To learn more, please visit pkgsite-cli’s documentation.

Stability and the future

This concludes our brief tour of the pkg.go.dev API. While we plan to expand the interface’s capabilities over time, we are committed to maintaining backward compatibility so that existing integrations continue to function seamlessly. (Note that command line interface of the pkgsite-cli reference client is not yet stable.) We welcome your feedback via our issue tracker, and we look forward to seeing the new tools and workflows the community will build.

Hello gophers,

We have just released Go versions 1.26.3 and 1.25.10, minor point releases.

These releases include 11 security fixes following the security policy:

• cmd/go: malicious module proxy can bypass checksum database

  A malicious module proxy could exploit a flaw in the go command's
  validation of module checksums to bypass checksum database validation.
  This vulnerability affects any user using an untrusted module proxy
  (GOMODPROXY) or checksum database (GOSUMDB).

  A malicious module proxy can serve altered versions of the Go toolchain.
  When selecting a different version of the Go toolchain than the
  currently installed toolchain (due to the GOTOOLCHAIN environment variable,
  or a go.work or go.mod with a toolchain line), the go command will download
  and execute a toolchain provided by the module proxy. A malicious module
  proxy can bypass checksum database validation for this downloaded
  toolchain.

  Since this vulnerability affects the security of toolchain downloads,
  setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade
  your base Go toolchain.

  The go tool always validates the hash of a toolchain before executing it,
  so fixed versions will refuse to execute any cached, altered versions of the
  toolchain.

  The go tool trusts go.sum files to contain accurate hashes of the current
  module's dependencies. A malicious proxy exploiting this vulnerability to
  serve an altered module will have caused an incorrect hash to be recorded
  in the go.sum. Users who have configured a non-trusted GOPROXY can determine
  if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify",
  which will revalidate all dependencies of the current module.

  The specific flaw in more detail:
  The go command consults the checksum database to validate downloaded modules,
  when a module is not listed in the go.sum file. It verifies that the module hash
  reported by the checksum database matches the hash of the downloaded module.
  If, however, the checksum database returns a successful response that contains
  no entry for the module, the go command incorrectly permitted validation to succeed.

  A module proxy may mirror or proxy the checksum database, in which case the go
  command will not connect to the checksum database directly. Checksums reported
  by the checksum database are cryptographically signed, so a malicious proxy
  cannot alter the reported checksum for a module. However, a proxy which returns
  an empty checksum response, or a checksum response for an unrelated module,
  could cause the go command to proceed as if a downloaded module has been validated.

  The go command now properly checks checksum database responses to ensure
  that the expected module signature is present, not just that if a signature is
  present it matches the expectation.

  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070.

• net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters

  When used with a Rewrite function, or a Director function which parses query parameters,
  ReverseProxy sanitizes the forwarded request to remove query parameters which are not
  parsed by url.ParseQuery. ReverseProxy did not take ParseQuery's limit on the total number
  of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account.

  This could permit ReverseProxy to forward a request containing a query parameter
  that was not visible to the Rewrite function.

  For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" could forward the parameter
  "hidden=y" while hiding it from the proxy's Rewrite function.

  ReverseProxy now avoids forwarding parameters that exceed the ParseQuery limit.

  This is CVE-2026-39825 and Go issue https://go.dev/issue/78948.

• net: panic in Dial and LookupPort when handling NUL byte on Windows

  The Dial and LookupPort functions would panic on Windows when provided
  with an input containing a NUL (0). These functions now return an error
  rather than panicking.

  This is CVE-2026-39836 and Go issue https://go.dev/issue/79006.

• net/mail: quadratic string concatenation in consumePhrase

  Pathological inputs could cause DoS through consumePhrase
  when parsing an email address according to RFC 5322.

  This is CVE-2026-42499 and Go issue https://go.dev/issue/78987.

• net/mail: quadratic string concatentation in consumeComment

  Well-crafted inputs reaching ParseAddress, ParseAddressList,
  and ParseDate were able to trigger excessive CPU exhaustion
  and memory allocations.

  This is CVE-2026-39820 and Go issue https://go.dev/issue/78566.

• cmd/go: "go bug" follows symlinks in predictable temporary filenames

  The "go bug" command wrote to two files with predictable names in
  the system temporary directory (for example, "/tmp").
  An attacker with access to the temporary directory could create a
  symlink in one of these names, causing "go bug" to overwrite the
  target of the symlink.

  The "go bug" command now uses os.MkdirTemp to create a safe
  working directory.

  Thanks to Harshit Gupta (Mr HAX) for reporting this issue.

  This is CVE-2026-39819 and Go issue https://go.dev/issue/78584.

• cmd/go: "go tool pack" does not sanitize output paths

  The "go tool pack" subcommand is a minimal version of the Unix ar utility.
  It is used by the compiler as an internal tool with known-good inputs.
  The "pack" subcommand did not sanitize output filenames.

  When invoked to extract a malicious archive file, it could write
  files to arbitrary locations on the filesystem.

  The "pack" subcommand now refuses to extract files with names
  containing any directory components.

  Thanks to Harshit Gupta (Mr HAX) for reporting this issue.

  This is CVE-2026-39817 and Go issue https://go.dev/issue/78778.

• net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of
  writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a
  value of 0.

  This allows potential DoS against a client by a malicious server. HTTP/2
  transport now properly checks that the received SETTINGS_MAX_FRAME_SIZE is
  valid.

  Thanks to Marwan Atia ([email protected]) for reporting this issue.

  This is CVE-2026-33814 and Go issue https://go.dev/issue/78476.

• html/template: escaper bypass leads to XSS

  If a trusted template author were to write a
  tag containing an empty type attribute or a type attribute with an ASCII whitespace, the execution of
  the template would incorrectly escape any data passed
  into the block.

  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

  This is CVE-2026-39826 and Go issue https://go.dev/issue/78981.

• net: crash when handling long CNAME response

  When using LookupCNAME with the cgo DNS resolver,
  a very long CNAME response could trigger a double-free of C memory
  and a crash. The double-free has been fixed.

  Thanks to hamayanhamayan for reporting this issue.

  This is CVE-2026-33811 and Go issue https://go.dev/issue/78803.

• html/template: bypass of meta content URL escaping causes XSS

  CVE-2026-27142 fixed a vulnerability in which URLs were not
  correctly escaped inside of a tag's attribute.

  If the URL content were to insert ASCII whitespaces around the = rune inside of the attribute, the escaper would
  fail to similarly escape it, leading to XSS.

  Dynamic inputs to a tag's attribute are now
  whitespace sanitized prior to escaping.

  Thanks to Samy Ghannad for reporting this issue.

  This is CVE-2026-39823 and Go issue https://go.dev/issue/78913.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.3

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.26.3 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Cherry and Michael for the Go team