Summary
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovered that Go did not correctly verify checksum database tiles
against their parents. An attacker in control of a malicious module proxy
could possibly use this issue to bypass checksum database verification and
serve malicious module content. (CVE-2026-56865)
It was discovered that the Go HTTP client incorrectly returned connections
to the idle pool after a rejected HTTP/1 CONNECT request with a request
body. A remote attacker could possibly use this issue to perform HTTP
response poisoning attacks against reverse proxies. (CVE-2026-56866)
It was discovered that the Go HTTP/2 server did not apply header limits to
Trailer headers. A remote attacker could possibly use this issue to cause
Go to use excessive resources, leading to a denial of service.
(CVE-2026-78659)
It was discovered that the Go HTTP/2 implementation did not remove
malformed framing-related headers when forwarding responses. A remote
attacker could possibly use this issue to perform HTTP response smuggling
attacks when Go was acting as a reverse proxy. (CVE-2026-78660)
It was discovered that the Go HTTP/2 server could refund connection-level
flow control twice for the same data under certain circumstances. A remote
attacker could possibly use this issue to bypass the configured
connection-level flow control limit. (CVE-2026-78663)
It was discovered that Go did not limit the size of Range headers parsed
when serving content over HTTP. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-78667)
It was discovered that the Go HTTP/2 implementation incorrectly handled
SETTINGS frames that changed the initial window size. A remote attacker
could possibly use this issue to cause Go to use excessive resources,
leading to a denial of service. (CVE-2026-78669)
It was discovered that the Go HTTP server continued to serve requests on a
connection after sending a successful response to an HTTP/1 CONNECT
request. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2026-94439)
It was discovered that Go did not enforce memory limits on the first line
of a part when parsing multipart forms. A remote attacker could possibly
use this issue to cause Go to use excessive resources, leading to a denial
of service. (CVE-2026-94440)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | golang-1.22 | 1.22.2-2~20.04.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | golang-1.22 | 1.22.2-2~22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | golang-1.22 | 1.22.2-2ubuntu0.5 |
Vulnerabilities 12
-
Critical 9.1
Double flow control refund on HTTP/2 server streams in net/http
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…
-
High 8.4
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to …
-
High 7.5
Enforce maximum recursion depth in encoding/asn1
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
-
High 7.5
Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
-
High 7.5
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…
-
High 7.5
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport…
-
High 7.5
HTTP/2 server memory exhaustion due to Trailer headers in net/http
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicio…
-
High 7.5
HTTP/2 transport accepts malformed framing-related headers in net/http
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such header…
-
High 7.5
Lack of limit on size of parsed Range headers in net/http
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
-
High 7.5
Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
-
High 7.5
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the …
-
High 7.5
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
References
-
report
https://ubuntu.com/security/CVE-2026-33818
-
report
https://ubuntu.com/security/CVE-2026-56859
-
report
https://ubuntu.com/security/CVE-2026-56862
-
report
https://ubuntu.com/security/CVE-2026-56865
-
report
https://ubuntu.com/security/CVE-2026-56866
-
report
https://ubuntu.com/security/CVE-2026-78659
-
report
https://ubuntu.com/security/CVE-2026-78660
-
report
https://ubuntu.com/security/CVE-2026-78663
-
report
https://ubuntu.com/security/CVE-2026-78667
-
report
https://ubuntu.com/security/CVE-2026-78669
-
report
https://ubuntu.com/security/CVE-2026-94439
-
report
https://ubuntu.com/security/CVE-2026-94440