Golang Go: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39836

  Panic in Dial and LookupPort when handling NUL byte on Windows in net

  The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42501

  Malicious module proxy can bypass checksum database in cmd/go

  A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-27142

  URLs in meta content attribute actions are not escaped in html/template

  Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be …

  Go standard library html/template langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• Medium 6.1
  CVE-2026-39823

  Bypass of meta content URL escaping causes XSS in html/template

  CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-39826

  Escaper bypass leads to XSS in html/template

  If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.9
  CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39825

  ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

  ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are…

  Go standard library net/http/httputil golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026

Revision history

1. 2026-11-12 #101

   Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-11 #100

   Neue Updates von Red Hat aufgenommen

3. 2026-11-10 #99

   Neue Updates von Red Hat aufgenommen

4. 2026-11-09 #98

   Neue Updates von Red Hat aufgenommen

5. 2026-11-08 #97

   Neue Updates von Red Hat aufgenommen

6. 2026-11-05 #96

   Neue Updates von Oracle Linux und Red Hat aufgenommen

7. 2026-11-04 #95

   Neue Updates von Red Hat aufgenommen

8. 2026-11-03 #94

   Neue Updates von Red Hat aufgenommen

9. 2026-11-02 #93

   Neue Updates von Red Hat aufgenommen

10. 2026-11-01 #92

    Neue Updates von Red Hat aufgenommen

11. 2026-10-29 #91

    Neue Updates von Red Hat aufgenommen

12. 2026-10-28 #90

    Neue Updates von Red Hat aufgenommen

13. 2026-10-27 #89

    Neue Updates von Red Hat aufgenommen

14. 2026-10-26 #88

    Neue Updates von Oracle Linux und Red Hat aufgenommen

15. 2026-10-25 #87

    Neue Updates von openSUSE aufgenommen

16. 2026-10-22 #86

    Neue Updates von Red Hat aufgenommen

17. 2026-10-21 #85

    Neue Updates von Red Hat aufgenommen

18. 2026-10-15 #84

    Neue Updates von Red Hat aufgenommen

19. 2026-10-14 #83

    Neue Updates von Red Hat aufgenommen

20. 2026-10-13 #82

    Neue Updates von Red Hat und IBM aufgenommen

21. 2026-10-12 #81

    Neue Updates von Red Hat aufgenommen

22. 2026-10-11 #80

    Neue Updates von Red Hat aufgenommen

23. 2026-10-07 #79

    Neue Updates von Red Hat und Splunk-SVD aufgenommen

24. 2026-10-06 #78

    Neue Updates von Red Hat aufgenommen

25. 2026-10-04 #77

    Neue Updates von SUSE aufgenommen

References

• Golang Announce vom 2026-05-07
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• openSUSE Security Update OPENSUSE-SU-2026:10723-1 vom 2026-05-10
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KAPID34AVTSUVR5VLMYLTSVPCBNB7627/
• Microsoft Security Update Guide vom 2026-05-12
  https://msrc.microsoft.com/update-guide/
• openSUSE Security Update OPENSUSE-SU-2026:10741-1 vom 2026-05-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T7UAVKUIB6GYXYYSMFI4JUIXBP2L5J62/
• SUSE Security Update SUSE-SU-2026:1861-1 vom 2026-05-15
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026078.html
• SUSE Security Update SUSE-SU-2026:1862-1 vom 2026-05-15
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026077.html
• openSUSE Security Update OPENSUSE-SU-2026:20763-1 vom 2026-05-19
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WVNMP2VUARXDVL6QMCH3D7RZTR3H7GXM/
• openSUSE Security Update OPENSUSE-SU-2026:20762-1 vom 2026-05-19
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V2GWOVADJGJB7KDSILDFCQFAYIGANRQ2/
• SUSE Security Update SUSE-SU-2026:2049-1 vom 2026-05-25
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026276.html
• openSUSE Security Update OPENSUSE-SU-2026:10849-1 vom 2026-05-25
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJSSIGOMBB7CI6H5MOSOL6B7XRBL5LKK/
• openSUSE Security Update OPENSUSE-SU-2026:10842-1 vom 2026-05-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RA6PKGM4RN2T2DFSXXNZRPYQVODGU2NO/
• openSUSE Security Update OPENSUSE-SU-2026:10845-1 vom 2026-05-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHOGVSQU7PY2NM3HOJ74FFNGCKPQAWFO/
• openSUSE Security Update OPENSUSE-SU-2026:10847-1 vom 2026-05-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MJJHAUMC4DQUYVQAXKFPGBARHDRTQYY5/
• openSUSE Security Update OPENSUSE-SU-2026:10848-1 vom 2026-05-25
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OTX2SNWG7ZECS2R52AXC5PHMPEUMYIH/
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-107 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-107.html
• SUSE Security Update SUSE-SU-2026:2079-1 vom 2026-05-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026311.html
• SUSE Security Update SUSE-SU-2026:2078-1 vom 2026-05-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026312.html
• Amazon Linux Security Advisory ALAS2-2026-3308 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3308.html
• Amazon Linux Security Advisory ALAS2-2026-3309 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3309.html
• Amazon Linux Security Advisory ALAS2-2026-3310 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3310.html
• Amazon Linux Security Advisory ALAS2-2026-3311 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3311.html
• Amazon Linux Security Advisory ALAS2-2026-3313 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3313.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-121 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-121.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-122 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-122.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-123 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-123.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-124 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-124.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-125 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-125.html
• Amazon Linux Security Advisory ALAS2-2026-3319 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3319.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-119 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-119.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-120 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-120.html
• Amazon Linux Security Advisory ALAS2ECS-2026-116 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-116.html
• Amazon Linux Security Advisory ALAS2ECS-2026-117 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-117.html
• Amazon Linux Security Advisory ALAS2ECS-2026-118 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-118.html
• Amazon Linux Security Advisory ALAS2ECS-2026-115 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-115.html
• Amazon Linux Security Advisory ALAS2ECS-2026-119 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-119.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-103 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-103.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-104 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-104.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-105 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-105.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-106 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-106.html
• Container-Optimized OS release notes vom 2026-05-27
  https://docs.cloud.google.com/container-optimized-os/docs/release-notes#May_26_2026
• SUSE Security Update SUSE-SU-2026:2093-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026364.html
• Red Hat Security Advisory RHSA-2026:17714 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:17714
• SUSE Security Update SUSE-SU-2026:2092-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026365.html
• SUSE Security Update SUSE-SU-2026:21804-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026341.html
• Red Hat Security Advisory RHSA-2026:17713 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:17713
• SUSE Security Update SUSE-SU-2026:21805-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026340.html
• Red Hat Security Advisory RHSA-2026:22120 vom 2026-06-01
  https://access.redhat.com/errata/RHSA-2026:22120
• SUSE Security Update SUSE-SU-2026:2192-1 vom 2026-06-01
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026419.html
• SUSE Security Update SUSE-SU-2026:2194-1 vom 2026-06-01
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026417.html
• SUSE Security Update SUSE-SU-2026:2193-1 vom 2026-06-01
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026418.html
• openSUSE Security Update OPENSUSE-SU-2026:10908-1 vom 2026-06-02
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VIBP73YHEJH5M2ITECIJTBYUZ4FOZFU/
• SUSE Security Update SUSE-SU-2026:21881-1 vom 2026-06-02
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026510.html
• openSUSE Security Update OPENSUSE-SU-2026:20854-1 vom 2026-06-02
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J65AQ42VT55IOXXFWFYBKROOWSYNGFDE/
• SUSE Security Update SUSE-SU-2026:21915-1 vom 2026-06-02
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026479.html
• Oracle Linux Security Advisory ELSA-2026-22112 vom 2026-06-04
  https://linux.oracle.com/errata/ELSA-2026-22112.html
• SUSE Security Update SUSE-SU-2026:2280-1 vom 2026-06-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026604.html
• openSUSE Security Update OPENSUSE-SU-2026:10921-1 vom 2026-06-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EFQITHNC7L7OCGIHU3ZTM3PZFHVW3KHV/
• SUSE Security Update SUSE-SU-2026:21987-1 vom 2026-06-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026594.html
• SUSE Security Update SUSE-SU-2026:21991-1 vom 2026-06-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026590.html
• SUSE Security Update SUSE-SU-2026:21989-1 vom 2026-06-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026592.html
• Red Hat Security Advisory RHSA-2026:23262 vom 2026-06-08
  https://access.redhat.com/errata/RHSA-2026:23262
• SUSE Security Update SUSE-SU-2026:22001-1 vom 2026-06-08
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026638.html
• Amazon Linux Security Advisory ALAS2-2026-3323 vom 2026-06-09
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3323.html
• Amazon Linux Security Advisory ALAS2ECS-2026-120 vom 2026-06-08
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-120.html
• Red Hat Security Advisory RHSA-2026:23264 vom 2026-06-08
  https://access.redhat.com/errata/RHSA-2026:23264
• Amazon Linux Security Advisory ALAS2-2026-3350 vom 2026-06-09
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3350.html
• SUSE Security Update SUSE-SU-2026:2325-1 vom 2026-06-09
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026667.html
• SUSE Security Update SUSE-SU-2026:2322-1 vom 2026-06-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026670.html
• SUSE Security Update SUSE-SU-2026:2315-1 vom 2026-06-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026674.html
• Ubuntu Security Notice USN-8430-1 vom 2026-06-16
  https://ubuntu.com/security/notices/USN-8430-1
• openSUSE Security Update OPENSUSE-SU-2026:0206-1 vom 2026-06-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/B42EZURG3AANFODWCZGWBCSN5P6KG4QT/
• SUSE Security Update SUSE-SU-2026:2460-1 vom 2026-06-19
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026838.html
• Oracle Linux Security Advisory ELSA-2026-22121 vom 2026-06-25
  https://linux.oracle.com/errata/ELSA-2026-22121.html
• SUSE Security Update SUSE-SU-2026:2643-1 vom 2026-06-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027016.html
• SUSE Security Update SUSE-SU-2026:2640-1 vom 2026-06-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027009.html
• SUSE Security Update SUSE-SU-2026:2639-1 vom 2026-06-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027010.html
• Red Hat Security Advisory RHSA-2026:33142 vom 2026-06-29
  https://access.redhat.com/errata/RHSA-2026:33142
• Red Hat Security Advisory RHSA-2026:32987 vom 2026-06-29
  https://access.redhat.com/errata/RHSA-2026:32987
• Red Hat Security Advisory RHSA-2026:33120 vom 2026-06-29
  https://access.redhat.com/errata/RHSA-2026:33120
• Red Hat Security Advisory RHSA-2026:33123 vom 2026-06-29
  https://access.redhat.com/errata/RHSA-2026:33123