Skip to content
cve.newCreate a CVE report

stdlib

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

unknown
CVE-2026-97054Package fixes recorded

HTTP/1 server crash due to MaxBytesReader header race in net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Recorded fixes — stdlib: 1.26.11 or 1.27.4. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6859

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium6.8
GO-2026-6809Package fixes recorded

Bundled root certificates allow trust in distrusted emSign intermediates

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.

Recorded fixes — webpki-roots: 0.26.11 or 1.0.10; rustls-webpki: 0.103.16 or 0.104.0-alpha.8; 2 more packages. Check your release branch.

Exploitation not established

crates.io / webpki-rootscrates.io / rustls-webpkicrates.io / webpki-root-certs
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.10Semantic versions1.26.10
From 1.27.0-0 before 1.27.3Semantic versions1.27.3

Version evidence: OSV · GO-2026-6809

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.10"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6617Package fixes recorded

HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Recorded fixes — stdlib: 1.26.9 or 1.27.2; golang.org/x/net: 0.60.0. Check your release branch.

Exploitation not established

Go / stdlibGo / golang.org/x/net
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9

Version evidence: OSV · GO-2026-6617

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6617

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6613Package fixes recorded

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.

Recorded fixes — stdlib: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6613

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6612Package fixes recorded

Double flow control refund on HTTP/2 server streams in net/http

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Recorded fixes — stdlib: 1.26.9 or 1.27.2; golang.org/x/net: 0.60.0. Check your release branch.

Exploitation not established

Go / stdlibGo / golang.org/x/net
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9

Version evidence: OSV · GO-2026-6612

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6612

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9

Version evidence: OSV · GO-2026-6611

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6611

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6610Package fixes recorded

HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Recorded fixes — stdlib: 1.26.9 or 1.27.2; golang.org/x/net: 0.60.0. Check your release branch.

Exploitation not established

Go / stdlibGo / golang.org/x/net
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9

Version evidence: OSV · GO-2026-6610

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6610

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6609Package fixes recorded

Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Recorded fixes — stdlib: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6609

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6608

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6607Package fixes recorded

Reject malformed ECH outer extension references in crypto/tls

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.

Recorded fixes — stdlib: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6607

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6605Package fixes recorded

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

Recorded fixes — stdlib: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6605

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6603Package fixes recorded

HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Recorded fixes — stdlib: 1.26.9 or 1.27.2; golang.org/x/net: 0.60.0. Check your release branch.

Exploitation not established

Go / stdlibGo / golang.org/x/net
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9

Version evidence: OSV · GO-2026-6603

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6603

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6600Package fixes recorded

Recognize yield as regexp preceder keyword in html/template

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.

Recorded fixes — stdlib: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6600

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6599

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6218Package fixes recorded

Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-6218

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6091Package fixes recorded

Fix Javascript regexp context tracking in html/template

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-6091

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6090Package fixes recorded

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-6090

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6089Package fixes recorded

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-6089

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6088Package fixes recorded

Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-6088

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high7.5
CVE-2026-33818Package fixes recorded

Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-5972

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-5856Package fixes recorded

Invoking Encrypted Client Hello privacy leak in crypto/tls

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Recorded fixes — stdlib: 1.25.12 or 1.26.5 or 1.27.0-rc.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.12Semantic versions1.25.12
From 1.26.0-0 before 1.26.5Semantic versions1.26.5
From 1.27.0-0 before 1.27.0-rc.2Semantic versions1.27.0-rc.2

Version evidence: OSV · GO-2026-5856

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.12"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.5"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4970Package fixes recorded

Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

Recorded fixes — stdlib: 1.25.12 or 1.26.5 or 1.27.0-rc.2. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.12Semantic versions1.25.12
From 1.26.0-0 before 1.26.5Semantic versions1.26.5
From 1.27.0-0 before 1.27.0-rc.2Semantic versions1.27.0-rc.2

Version evidence: OSV · GO-2026-4970

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.12"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.5"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-5039Package fixes recorded

Arbitrary inputs are included in errors without any escaping in net/textproto

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Recorded fixes — stdlib: 1.25.11 or 1.26.4. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.11Semantic versions1.25.11
From 1.26.0-0 before 1.26.4Semantic versions1.26.4

Version evidence: OSV · GO-2026-5039

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.11"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-5037Package fixes recorded

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

Recorded fixes — stdlib: 1.25.11 or 1.26.4. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.11Semantic versions1.25.11
From 1.26.0-0 before 1.26.4Semantic versions1.26.4

Version evidence: OSV · GO-2026-5037

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.11"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.11Semantic versions1.25.11
From 1.26.0-0 before 1.26.4Semantic versions1.26.4

Version evidence: OSV · GO-2026-5038

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.11"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-5026Package fixes recorded

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

Recorded fixes — stdlib: 1.25.13 or 1.26.6 or 1.27.0-rc.3; golang.org/x/net: 0.55.0. Check your release branch.

Exploitation not established

Go / stdlibGo / golang.org/x/net
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.13Semantic versions1.25.13
From 1.26.0-0 before 1.26.6Semantic versions1.26.6
From 1.27.0-0 before 1.27.0-rc.3Semantic versions1.27.0-rc.3

Version evidence: OSV · GO-2026-5026

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.13"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.6"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.0-rc.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4986Package fixes recorded

Quadratic string concatentation in consumeComment in net/mail

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Recorded fixes — stdlib: 1.25.10 or 1.26.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4986

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4982Package fixes recorded

Bypass of meta content URL escaping causes XSS in html/template

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

Recorded fixes — stdlib: 1.25.10 or 1.26.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4982

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4981Package fixes recorded

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Recorded fixes — stdlib: 1.25.10 or 1.26.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4981

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4980Package fixes recorded

Escaper bypass leads to XSS in html/template

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Recorded fixes — stdlib: 1.25.10 or 1.26.3. Check your release branch.

Exploitation not established

Go / stdlib
stdlib Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4980

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}