Golang Go: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• High 8.4
  CVE-2026-56865

  Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

  A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to …

  Go toolchain golang.org/x/mod cmd/go golang.org/x/mod/sumdb/tlog Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-33818

  Enforce maximum recursion depth in encoding/asn1

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

  Go standard library encoding/asn1 katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-46600

  Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

  Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

  Go standard library golang.org/x/net net golang.org/x/net/dns/dnsmessage Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 21, 2026
• High 7.5
  CVE-2026-56853

  Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

  When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56859

  Add recursion depth guard during decode in encoding/xml

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56862

  Limit handshake messages we are willing to accept post-handshake in crypto/tls

  Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56864

  Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

  A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the trans…

  Go toolchain golang.org/x/mod cmd/go golang.org/x/mod/sumdb Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 6.1
  CVE-2026-56858

  Fix Javascript regexp context tracking in html/template

  Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

  Go standard library html/template katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 5.9
  CVE-2026-56860

  Avoid quadratic complexity in resolvePath in net/url

  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

  Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026

Revision history

1. 2026-11-12 #61

   Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-11 #60

   Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

3. 2026-11-10 #59

   Neue Updates von Red Hat aufgenommen

4. 2026-11-09 #58

   Neue Updates von Red Hat aufgenommen

5. 2026-11-08 #57

   Neue Updates von Red Hat aufgenommen

6. 2026-11-05 #56

   Neue Updates von Red Hat und Oracle Linux aufgenommen

7. 2026-11-04 #55

   Neue Updates von Red Hat aufgenommen

8. 2026-11-03 #54

   Neue Updates von Red Hat aufgenommen

9. 2026-11-02 #53

   Neue Updates von Red Hat aufgenommen

10. 2026-11-01 #52

    Neue Updates von Red Hat aufgenommen

11. 2026-10-29 #51

    Neue Updates von Red Hat aufgenommen

12. 2026-10-28 #50

    Neue Updates von Red Hat und Oracle Linux aufgenommen

13. 2026-10-27 #49

    Neue Updates von Red Hat aufgenommen

14. 2026-10-26 #48

    Neue Updates von Red Hat und Oracle Linux aufgenommen

15. 2026-10-25 #47

    Neue Updates von Red Hat aufgenommen

16. 2026-10-22 #46

    Neue Updates von Red Hat aufgenommen

17. 2026-10-21 #45

    Neue Updates von Red Hat aufgenommen

18. 2026-10-20 #44

    Neue Updates von Red Hat aufgenommen

19. 2026-10-19 #43

    Neue Updates von Red Hat aufgenommen

20. 2026-10-18 #42

    Neue Updates von openSUSE aufgenommen

21. 2026-10-15 #41

    Neue Updates von Ubuntu aufgenommen

22. 2026-10-14 #40

    Neue Updates von Red Hat aufgenommen

23. 2026-10-13 #39

    Neue Updates von Red Hat aufgenommen

24. 2026-10-12 #38

    Neue Updates von Red Hat aufgenommen

25. 2026-10-11 #37

    Neue Updates von Red Hat aufgenommen

References

• OSS Security Mailing list vom 2026-08-13
  https://seclists.org/oss-sec/2026/q3/487
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-5972
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6088
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6089
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6090
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6091
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6179
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6180
• Go Vulnerability Report vom 2026-08-13
  https://pkg.go.dev/vuln/GO-2026-6218
• openSUSE Security Update OPENSUSE-SU-2026:11517-1 vom 2026-08-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XLJUFMJN2M3YEPFPNXPF4GTNYPWSPD3E/
• openSUSE Security Update OPENSUSE-SU-2026:11516-1 vom 2026-08-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CQT5XHRMVVQQJMPZ4VMFVOHKMW2F4VL2/
• SUSE Security Update SUSE-SU-2026:3640-1 vom 2026-08-18
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028390.html
• Red Hat Security Advisory RHSA-2026:56223 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:56223
• Red Hat Security Advisory RHSA-2026:56143 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:56143
• SUSE Security Update SUSE-SU-2026:3641-1 vom 2026-08-18
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028389.html
• Red Hat Security Advisory RHSA-2026:54580 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:54580
• openSUSE Security Update OPENSUSE-SU-2026:21593-1 vom 2026-08-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UHHCXFWGC6CBH4D6OH2F64XPDLP3QFX2/
• openSUSE Security Update OPENSUSE-SU-2026:21592-1 vom 2026-08-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/53ECMK7DHSIH5JIRF6WZ4NUGYR34BBHA/
• Red Hat Security Advisory RHSA-2026:57541 vom 2026-08-20
  https://access.redhat.com/errata/RHSA-2026:57541
• Red Hat Security Advisory RHSA-2026:57649 vom 2026-08-20
  https://access.redhat.com/errata/RHSA-2026:57649
• openSUSE Security Update OPENSUSE-SU-2026:11536-1 vom 2026-08-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OVQCMGW5WP26AF3B3LHZVLGSUZ7WBCWJ/
• Red Hat Security Advisory RHSA-2026:59546 vom 2026-08-25
  https://access.redhat.com/errata/RHSA-2026:59546
• Red Hat Security Advisory RHSA-2026:60306 vom 2026-08-27
  https://access.redhat.com/errata/RHSA-2026:60306
• Red Hat Security Advisory RHSA-2026:60305 vom 2026-08-26
  https://access.redhat.com/errata/RHSA-2026:60305
• Red Hat Security Advisory RHSA-2026:60304 vom 2026-08-26
  https://access.redhat.com/errata/RHSA-2026:60304
• SUSE Security Update SUSE-SU-2026:3799-1 vom 2026-08-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028536.html
• SUSE Security Update SUSE-SU-2026:3800-1 vom 2026-08-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028535.html
• Rocky Linux Security Advisory RLSA-2026:60305 vom 2026-08-26
  https://errata.build.resf.org/RLSA-2026:60305
• Rocky Linux Security Advisory RLSA-2026:60306 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:60306
• Rocky Linux Security Advisory RLSA-2026:60304 vom 2026-08-27
  https://errata.build.resf.org/RLSA-2026:60304
• SUSE Security Update SUSE-SU-2026:3815-1 vom 2026-08-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028607.html
• SUSE Security Update SUSE-SU-2026:3830-1 vom 2026-08-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028614.html
• SUSE Security Update SUSE-SU-2026:3816-1 vom 2026-08-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-August/028606.html
• Red Hat Security Advisory RHSA-2026:61253 vom 2026-08-31
  https://access.redhat.com/errata/RHSA-2026:61253
• Red Hat Security Advisory RHSA-2026:61882 vom 2026-09-01
  https://access.redhat.com/errata/RHSA-2026:61882
• openSUSE Security Update OPENSUSE-SU-2026:21705-1 vom 2026-08-31
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I5M5GH7B62GOI7FISE23QFPEOYMAS3A7/
• Amazon Linux Security Advisory ALAS2-2026-3893 vom 2026-09-01
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3893.html
• openSUSE Security Update OPENSUSE-SU-2026:11631-1 vom 2026-08-31
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6FWEHCQNF65WUUGJLADG2GH7E3JDOAKG/
• Oracle Linux Security Advisory ELSA-2026-60306 vom 2026-08-31
  https://linux.oracle.com/errata/ELSA-2026-60306-0.html
• Red Hat Security Advisory RHSA-2026:62405 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62405
• Red Hat Security Advisory RHSA-2026:62407 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62407
• Red Hat Security Advisory RHSA-2026:62406 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62406
• Red Hat Security Advisory RHSA-2026:62577 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62577
• Red Hat Security Advisory RHSA-2026:62754 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62754
• Red Hat Security Advisory RHSA-2026:62753 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62753
• Red Hat Security Advisory RHSA-2026:63124 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63124
• Red Hat Security Advisory RHSA-2026:62602 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62602
• Red Hat Security Advisory RHSA-2026:62578 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62578
• Red Hat Security Advisory RHSA-2026:62631 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62631
• Red Hat Security Advisory RHSA-2026:62851 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:62851
• Oracle Linux Security Advisory ELSA-2026-60304 vom 2026-09-02
  https://linux.oracle.com/errata/ELSA-2026-60304-0.html
• Red Hat Security Advisory RHSA-2026:63022 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63022
• Rocky Linux Security Advisory RLSA-2026:62406 vom 2026-09-03
  https://errata.build.resf.org/RLSA-2026:62406
• Rocky Linux Security Advisory RLSA-2026:62407 vom 2026-09-03
  https://errata.build.resf.org/RLSA-2026:62407
• Oracle Linux Security Advisory ELSA-2026-62631 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62631-0.html
• Oracle Linux Security Advisory ELSA-2026-62578 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62578-0.html
• Red Hat Security Advisory RHSA-2026:62803 vom 2026-09-02
  https://access.redhat.com/errata/RHSA-2026:62803
• Red Hat Security Advisory RHSA-2026:63130 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63130
• Red Hat Security Advisory RHSA-2026:63136 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63136
• Rocky Linux Security Advisory RLSA-2026:62578 vom 2026-09-03
  https://errata.build.resf.org/RLSA-2026:62578
• Rocky Linux Security Advisory RLSA-2026:62577 vom 2026-09-03
  https://errata.build.resf.org/RLSA-2026:62577
• Oracle Linux Security Advisory ELSA-2026-62407 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62407-0.html
• Red Hat Security Advisory RHSA-2026:63163 vom 2026-09-04
  https://access.redhat.com/errata/RHSA-2026:63163
• Oracle Linux Security Advisory ELSA-2026-62577 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62577-0.html
• Red Hat Security Advisory RHSA-2026:63119 vom 2026-09-04
  https://access.redhat.com/errata/RHSA-2026:63119
• Red Hat Security Advisory RHSA-2026:63127 vom 2026-09-04
  https://access.redhat.com/errata/RHSA-2026:63127
• Oracle Linux Security Advisory ELSA-2026-60305 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-60305-0.html
• Rocky Linux Security Advisory RLSA-2026:63163 vom 2026-09-04
  https://errata.build.resf.org/RLSA-2026:63163
• Red Hat Security Advisory RHSA-2026:63332 vom 2026-09-04
  https://access.redhat.com/errata/RHSA-2026:63332
• Oracle Linux Security Advisory ELSA-2026-62406 vom 2026-09-03
  https://linux.oracle.com/errata/ELSA-2026-62406-0.html
• Rocky Linux Security Advisory RLSA-2026:62631 vom 2026-09-03
  https://errata.build.resf.org/RLSA-2026:62631
• Oracle Linux Security Advisory ELSA-2026-63119 vom 2026-09-04
  https://linux.oracle.com/errata/ELSA-2026-63119-0.html
• Oracle Linux Security Advisory ELSA-2026-63124 vom 2026-09-04
  https://linux.oracle.com/errata/ELSA-2026-63124-0.html
• Red Hat Security Advisory RHSA-2026:64788 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:64788
• Red Hat Security Advisory RHSA-2026:64818 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:64818
• Red Hat Security Advisory RHSA-2026:65117 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:65117
• Oracle Linux Security Advisory ELSA-2026-63136 vom 2026-09-07
  https://linux.oracle.com/errata/ELSA-2026-63136-0.html
• Red Hat Security Advisory RHSA-2026:64786 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:64786
• Red Hat Security Advisory RHSA-2026:65336 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:65336
• Red Hat Security Advisory RHSA-2026:65335 vom 2026-09-08
  https://access.redhat.com/errata/RHSA-2026:65335