Go Updates & Release Notes

Today the Go team is pleased to release Go 1.27. You can find its binary archives and installers on the download page.

Go 1.27 brings major enhancements across the language, toolchain, runtime, and standard library. Below are some of the key highlights.

Language changes

Go 1.27 introduces three notable updates to the language specification.

First, generic methods are now supported. For example, see math/rand/v2.Rand:

// Prior to Go 1.27, a separate method on Rand had to be added for each type
// (unsigned integer methods omitted for brevity).
func (r *Rand) Int32N(n int32) int32
func (r *Rand) Int64N(n int64) int64
func (r *Rand) IntN(n int)

// Go 1.27 adds a new generic method that works for all integer types.
func (r *Rand) N[Int intType](n Int) Int

Second, a key in a struct literal may now be any valid field selector for the struct type, allowing fields in nested or embedded structs to be initialized directly:

type Habitat struct {
    Burrow string
}

type Gopher struct {
    Name    string
    Habitat // Embedded struct.
}

// Go 1.27 allows using Burrow as a key directly.
g := Gopher{
    Name:   "Gopher",
    Burrow: "Burrow #42",
}

Finally, function type inference has been generalized to apply in all assignment contexts. Generic functions can now be used without explicit type arguments in composite literals, type conversions, and channel sends:

func GenericFormatter[T any](v T) string {
    return fmt.Sprintf("value: %v", v)
}

type IntFormatter func(int) string

// Go 1.27 infers T = int in composite literals, conversions, and channel sends.
formatters := []IntFormatter{GenericFormatter}
fn := IntFormatter(GenericFormatter)
ch := make(chan IntFormatter, 1)
ch <- GenericFormatter

Tool improvements

• go fix includes several new modernizers: atomictypes, embedlit, slicesbackward, and unsafefuncs.
• go doc now supports package@version queries such as go doc example.com/[email protected].
• go mod tidy now automatically consolidates multiple require blocks in go.mod into a standard direct and indirect two-block structure.

Performance and runtime

• Size-specialized memory allocation reduces small object (<80B) allocation costs by up to 30%, improving overall performance by ~1% for allocation-heavy programs.
• The goroutineleak profile in runtime/pprof is now generally available, allowing automatic detection of permanently blocked goroutines.

Standard library additions

• encoding/json/v2 provides high-level JSON processing with configurable options and stricter defaults, alongside encoding/json/jsontext for low-level streaming. The existing encoding/json package is now backed by the v2 implementation for faster unmarshaling while maintaining backwards compatibility.
• crypto/mldsa implements the post-quantum ML-DSA signature scheme (FIPS 204), integrated into crypto/x509 and crypto/tls.
• uuid provides native support for generating and parsing UUIDs.
• simd and architecture-specific simd/archsimd provide experimental SIMD support.
• net/http/httptest adds NewTestServer, providing an in-memory fake network suitable for use with the testing/synctest package.

Please read the Go 1.27 release notes for the complete list of changes and details.

Over the next few weeks, follow-up blog posts will cover some of the topics relevant to Go 1.27 in more detail. Check back later to read those posts.

Thanks to everyone who contributed to this release by writing code, filing bugs, trying out experimental additions, and testing release candidates. As always, if you notice any problems, please file an issue.

We hope you enjoy using Go 1.27!

Hello gophers,

We have just released Go versions 1.26.7 and 1.25.14, minor point releases.

View the release notes for more information:

https://go.dev/doc/devel/release#go1.26.7

You can download binary and source distributions from the Go website:

https://go.dev/dl/

To compile from source using a Git clone, update to the release with

git checkout go1.26.7

and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,

Carlos and Dmitri for the Go team

Hello gophers,

These minor releases include a fix to address a breakage affecting unencrypted HTTP/2 (h2c) connections caused by a security patch included in last week’s release. See

go.dev/issue/80876

for details. This fix is also included in Go 1.27.0 (also being released today).

Thanks,

Carlos and Dmitri for the Go team

Hello gophers,

We have just released Go 1.27.0.

To find out what has changed in Go 1.27, read the release notes:
https://go.dev/doc/go1.27

You can download binary and source distributions from our download page:
https://go.dev/dl/#go1.27.0

If you have Go installed already, an easy way to try go1.27.0
is by using the go command:

$ go install golang.org/dl/go1.27.0@latest
$ go1.27.0 download

To compile from source using a Git clone, update to the release with

git checkout go1.27.0

and build as usual.

Thanks to everyone who contributed to the release!

Cheers,
Carlos and Dmitri for the Go team

Hello gophers,

We have tagged version v0.40.0 of golang.org/x/mod in order to address the following security issues:

x/mod/sumdb/tlog: fix transparency log tile verification bypass

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to Filippo Valsorda (Geomys) for reporting this issue.

This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to mundur for reporting this issue.

This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

Cheers,
Go Security team

Hello gophers,

We have just released go1.27rc3, a release candidate version of Go 1.27.
It is cut from release-branch.go1.27 at the revision tagged go1.27rc3.

This release includes 10 security fixes following the security policy:

• x/mod/sumdb/tlog: fix transparency log tile verification bypass

A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

• x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.

This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.

In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy

Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

• encoding/xml: add recursion depth guard during decode

Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.

This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

• net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check

When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.

This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

• net/url: avoid quadratic complexity in resolvePath

Previously, resolving relative paths containing parent directory ( .. ) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.

• golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record

Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

• crypto/tls: limit handshake messages we are willing to accept post-handshake

Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.

Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

• html/template: fix Javascript regexp context tracking

Previously, pathological inputs could close an
unescaped / early, allowing for attack-controlled
data to inject arbitrary content, potentially
leading to XSS.

Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.

• x/net/idna: failure to reject ASCII-only Punycode-encoded labels

The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.

The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.

This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".

Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

• encoding/asn1: enforce maximum recursion depth

Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.

Thanks to Marwan Atia ([email protected]) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

Please try your production load tests and unit tests with the new version.

Your help testing these pre-release versions is invaluable.
Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to Go telemetry if you haven't already.
Go telemetry helps validate this release candidate and future Go releases.
You can opt in by running the following command:
$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc3
is by using the go command:
$ go install golang.org/dl/go1.27rc3@latest
$ go1.27rc3 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc3

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,
Dmitri and Mark for the Go team

Hello gophers,

We have just released Go versions 1.26.6 and 1.25.13, minor point releases.

These releases include 10 security fixes following the security policy:

• x/mod/sumdb/tlog: fix transparency log tile verification bypass

  A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:
  rm -r go.sum go.work.sum vendor/ && go mod tidy
  Thanks to Filippo Valsorda (Geomys) for reporting this issue.
  This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.

• x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup

  A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:
  rm -r go.sum go.work.sum vendor/ && go mod tidy
  Thanks to mundur for reporting this issue.
  This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.

• encoding/xml: add recursion depth guard during decode

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
  This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

• net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check

  When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Previously, this was being done with no timeout applied. ReadHeaderTimeout is now applied for this.
  This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.

• net/url: avoid quadratic complexity in resolvePath

  Previously, resolving relative paths containing parent directory (..) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
  This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.

• golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record

  Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
  This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.

• crypto/tls: limit handshake messages we are willing to accept post-handshake

  Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
  Thanks to Qi Deng of Aurascape.ai for reporting this issue.
  This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.

• html/template: fix Javascript regexp context tracking

  Previously, pathological inputs could close an unescaped / early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
  Thanks to Ali Sherif for reporting this issue.
  This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.

• x/net/idna: failure to reject ASCII-only Punycode-encoded labels

  The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returned the name "example.com" rather than an error. The idna package implements the processing algorithm from UTS 46. Older versions of UTS 46 included a specification bug which permitted multiple ASCII labels to decode to the same Unicode label. UTS 46 revision 33 fixed the specification bug. The idna package now implements the updated specification. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
  Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
  This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

• encoding/asn1: enforce maximum recursion depth

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
  Thanks to Marwan Atia ([email protected]) for reporting this issue.
  This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.6

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with

git checkout go1.26.6

and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Dmitri and Mark for the Go team

Hello gophers,

We have just released go1.27rc2, a release candidate version of Go 1.27.

It is cut from release-branch.go1.27 at the revision tagged go1.27rc2.

This release includes 2 security fixes following the security policy:

os: Root escape via symlink plus trailing slash

On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.

For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.

On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.

It now properly sanitizes the path parameter provided to openat.

Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

crypto/tls: Encrypted Client Hello privacy leak

The Encrypted Client Hello implementation would leak the pre-shared key
identities during the handshake, allowing a passive network observer who can
collect handshakes to de-anonymize the hostname of the server, even when ECH was
being used.

Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

Please try your production load tests and unit tests with the new version.

Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to Go telemetry if you haven't already.

Go telemetry helps validate this release candidate and future Go releases.

You can opt in by running the following command:

$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc2
is by using the go command:

$ go install golang.org/dl/go1.27rc2@latest
$ go1.27rc2 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc2

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,

Junyang and David for the Go team

Hello gophers,

We have just released Go versions 1.26.5 and 1.25.12, minor point releases.

These releases include 2 security fixes following the security policy:

• os: Root escape via symlink plus trailing slash

  On Unix systems, opening a file in an os.Root improperly followed symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

  For example, root.Open("symlink/") would open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

  On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks in path when path ends in a /. Root failed to account for this behavior, permitting paths with a trailing / to escape.

  It now properly sanitizes the path parameter provided to openat.

  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

  This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

• crypto/tls: Encrypted Client Hello privacy leak

  The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

  This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.5

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.26.5 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Junyang and David for the Go team

Hello gophers,

We have just released go1.27rc1, a release candidate version of Go 1.27.
It is cut from release-branch.go1.27 at the revision tagged go1.27rc1.
Please try your production load tests and unit tests with the new version.
Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to
Go telemetry
if you haven't already.
Go telemetry helps validate this release candidate and future Go releases.
You can opt in by running the following command:

$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc1
is by using the go command:

$ go install
golang.org/dl/go1.27rc1@latest
$ go1.27rc1 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc1

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,

Dmitri and Cherry for the Go team

Hello gophers,

We have just released Go versions 1.26.4 and 1.25.11, minor point releases.

These releases include 3 security fixes following the security policy:

• mime: quadratic complexity in WordDecoder.DecodeHeader
  Decoding a maliciously-crafted MIME header containing many invalid
  encoded-words could consume excessive CPU.
  The MIME decoder now better handles this case.
  Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
  This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.

• net/textproto: arbitrary input are included in errors without any escaping
  When returning errors, functions in the net/textproto package would
  include its input as part of the error, without any escaping. Note that
  said input is often controlled by external parties when using this
  package naturally. For example, a net/http client uses ReadMIMEHeader
  when parsing the headers it receive from a server.
  As a result, an attacker could inject arbitrary content into the error.
  Practically, this can result in an attacker injecting misleading
  content, terminal control bytes, etc. into a victim's output or logs.
  This is CVE-2026-42507 and Go issue https://go.dev/issue/79346

• crypto/x509: split candidate hostname only once
  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
  over all DNS Subject Alternative Name (SAN) entries. This caused
  strings.Split(host, ".") to execute repeatedly on the same input hostname.
  With a large DNS SAN list, verification costs scaled quadratically based on the
  number of SAN entries multiplied by the hostname's label count. Because
  x509.Verify validates hostnames before building the certificate chain, this
  overhead occurred even for untrusted certificates.
  Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
  This is CVE-2026-27145 and https://go.dev/issue/79694.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with

git checkout go1.26.4

and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,

The Go team

Ahoy gophers,

We have tagged version v0.52.0 of golang.org/x/crypto in order to address the following security issues:

ssh/agent: pathological inputs can lead to client panic

For certain crafted inputs, a ed25519.PrivateKey was created by casting malformed wire bytes, leading to a panic when used.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-46598 and Go issue https://go.dev/issue/79596.

ssh: byte arithmetic causes underflow and panic

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Thanks to Maciej Kawka for reporting this issue.

This is CVE-2026-46597 and Go issue https://go.dev/issue/79561.

ssh: bypass of certificate restrictions

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39828 and Go issue https://go.dev/issue/79562.

ssh: server panic during CheckHostKey/Authenticate

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39835 and Go issue https://go.dev/issue/79563.

ssh/agent: key constraints not enforced

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39833 and Go issue https://go.dev/issue/79436.

ssh/agent: agent constraints dropped when forwarding keys

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39832 and Go issue https://go.dev/issue/79435.

ssh: memory leak when rejecting channels can lead to DoS

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Thanks to Ziyan Zhou for reporting this issue.

This is CVE-2026-39827 and Go issue https://go.dev/issue/35127.

ssh: client can cause server deadlock on unexpected responses

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39830 and Go issue https://go.dev/issue/79564.

ssh: pathological RSA/DSA parameters may cause DoS

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39829 and Go issue https://go.dev/issue/79565.

ssh: bypass of FIDO/U2F security keys physical interaction

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39831 and Go issue https://go.dev/issue/79566.

ssh: infinite loop on large channel writes

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Thanks to NCC Group Cryptography Services, sponsored by Teleport for reporting this issue.

This is CVE-2026-39834 and Go issue https://go.dev/issue/79567.

ssh/knownhosts: auth bypass via unenforced @revoked status

Previously, a revoked SignatureKey belonging to a CA was not correctly checked for revocation. Now, both the key and key.SignatureKey are checked for @revoked.

This is CVE-2026-42508 and Go issue https://go.dev/issue/79568.

ssh: VerifiedPublicKeyCallback permissions skip enforcement

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

This is CVE-2026-46595 and Go issue https://go.dev/issue/79570.

Cheers,

Go Security Team

Hello gophers,

We have tagged version v0.41.0 of golang.org/x/image in order to address the following security issues:

x/image/bmp: panic when reading out of bound palette index

Decoding a paletted BMP file with an out-of-range palette index would result in a panic when accessing pixels in the invalid image. Decoding now correctly returns an error in this case. This is CVE-2026-42500 and Go issue https://go.dev/issue/79576.

x/image/tiff: excessive resource consumption in PackBits decompression

The TIFF decoder did not place a limit on the size of PackBits-compressed data. A maliciously-crafted image could exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data. The decoder now limits the amount of PackBits-compressed data it will decompress. Thanks to Uuganbayar Lkhamsuren for reporting this issue. This is CVE-2026-33809 and Go issue https://go.dev/issue/79577.

Cheers,

Go Security team

Hello gophers,

We have tagged version v0.55.0 of golang.org/x/net in order to address the following security issues:

html: incorrect handling of namespaced elements in foreign content

The HTML parser mishandled certain namespaced elements in foreign content,
causing them to be incorrectly rendered. This can lead to XSS when rendering
parsed HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-42506 and Go issue https://go.dev/issue/79571.

x/net/idna: failure to reject ASCII-only Punycode-encoded labels

The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.

The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.

This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".

Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.

This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.

html: incorrect handling of HTML elements in foreign content

The HTML parser mishandled certain HTML elements in foreign content, causing
them to be incorrectly rendered. This can lead to XSS when rendering parsed
HTML.

Thanks to Tristan Madani for reporting this issue.

This is CVE-2026-42502 and Go issue https://go.dev/issue/79572.

html: denial of service when parsing arbitrary HTML

Due to the use of a cubic complexity algorithm during the HTML tree construction
stage, parsing arbitrary HTML can consume excessive CPU time.

Thanks to IPC Labs for reporting this issue.

This is CVE-2026-25680 and Go issue https://go.dev/issue/79573.

html: incorrect handling of character references in DOCTYPE nodes

The HTML parser mishandled character references in DOCTYPE nodes, causing
them to be incorrectly rendered. This can lead to XSS when rendering parsed
HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-25681 and Go issue https://go.dev/issue/79574.

html: duplicate attributes can cause XSS

The HTML parser did not properly handle multiple duplicate attributes, causing
the parser to misparse certain HTML trees. This can cause XSS when rendering
parsed HTML.

Thanks to ensy for reporting this issue.

This is CVE-2026-27136 and Go issue https://go.dev/issue/79575.

Cheers,
Go Security team

Howdy gophers,

We have tagged version v0.45.0 of golang.org/x/sys in order to address a security issue.

windows: integer overflow in NewNTUnicodeString

NewNTUnicodeString did not check for string length overflow.
When provided with a string that overflows the maximum size of a
NTUnicodeString (a 16-bit number of bytes), it returned a truncated
string rather than an error.

It now correctly returns an error when provided with a too-long string.

This is CVE-2026-39824 and Go issue https://go.dev/issue/78916.

Cheers,

Go Security Team