Skip to content
OpenAdvisories
High · 7.5 CVE-2026-56866 BIT-golang-2026-56866EUVD-2026-95421GHSA-f5vf-8pvc-394gGO-2026-6605

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

Published Oct 8, 2026 · Updated Oct 9, 2026 · Assigned by Go

Vendor: Go standard library Product: net/http Product: net/http/httputil Package: aactl Package: actions-runner-controller Package: addon-resizer Package: apache-exporter Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-workflow-controller-4.0 Package: argo-workflow-executor-3.7 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: atlantis Package: authservice Package: aws-application-networking-k8s Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-network-policy-agent Package: aws-node-termination-handler Package: aws-nuke Package: aws-otel-collector Package: aws-otel-collector-healthcheck Package: azure-service-operator Package: azuredisk-csi-1.34 Package: bank-vaults Package: bank-vaults-template Package: blob-csi-1.27 Package: bom Package: calico-apiserver-3.31 Package: calico-apiserver-3.32 Package: calico-app-policy-3.31 Package: calico-app-policy-3.32 Package: calico-cni-3.31 Package: calico-cni-3.32 Package: calico-felix-3.31 Package: calico-felix-3.32 Package: calico-goldmane-3.31 Package: calico-goldmane-3.32 Package: calico-key-cert-provisioner-3.31 Package: calico-key-cert-provisioner-3.32 Package: calico-kube-controllers-3.31 Package: calico-kube-controllers-3.32 Package: calico-node-3.31 Package: calico-node-3.32 Package: calico-typha-client-3.31 Package: calico-typha-client-3.32 Package: calico-typhad-3.31 Package: calico-typhad-3.32 Package: calico-whisker-backend-3.31 Package: calico-whisker-backend-3.32 Package: calicoctl-3.31 Package: calicoctl-3.32 Package: cass-operator Package: cert-exporter Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cmctl Package: cert-manager-controller-1.20 Package: cert-manager-istio-csr Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cert-manager-webhook-pdns Package: certificate-transparency-trillian-ctserver Package: cfssl Package: cfssl-bundle Package: cfssl-mkbundle Package: cfssl-multirootca Package: cfssl-newkey Package: cfssl-scan Package: chart-testing Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cis-operator-1.4 Package: cloud-provider-aws-1.35-cloud-controller-manager Package: cloud-provider-aws-1.35-ecr-credential-provider Package: cloud-provider-aws-1.36-cloud-controller-manager Package: cloud-provider-aws-1.36-ecr-credential-provider Package: cloud-provider-azure-cloud-controller-manager-1.36 Package: cloud-provider-azure-cloud-node-manager-1.36 Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.21 Package: cloud-sql-proxy-2.22 Package: cloud-sql-proxy-2.26 Package: cloudprober Package: cluster-api-1.12-clusterctl Package: cluster-api-1.12-controller Package: cluster-api-1.12-kubeadm-bootstrap-controller Package: cluster-api-1.12-kubeadm-control-plane-controller Package: cluster-api-1.13-capd-manager Package: cluster-api-1.13-clusterctl Package: cluster-api-1.13-controller Package: cluster-api-1.13-kubeadm-bootstrap-controller Package: cluster-api-1.13-kubeadm-control-plane-controller Package: cluster-api-aws-controller Package: cluster-api-gcp-controller Package: cluster-api-ipam-provider-in-cluster Package: cluster-proportional-autoscaler Package: cni-plugins-all Package: configmap-reload Package: confluent-cp-docker-utils Package: conftest Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: continuity Package: coredns-1.14 Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-sns Package: custom-pod-autoscaler-operator Package: datadog-agent-7.77 Package: datadog-agent-7.77-fakeintake Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-fakeintake Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: delve Package: dfc-mcp-server Package: direnv Package: docker-credential-ecr-login Package: dockerize Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: doppler-kubernetes-operator Package: emissary Package: emissary-apiext Package: etcd-3.6 Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: external-secrets-operator-2.6 Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: filebrowser Package: fluent-bit-plugin-loki Package: fluent-operator Package: flux-2.7 Package: flux-2.8 Package: flux-source-controller Package: gatus Package: gcc Package: gcsfuse Package: git-credential-oauth Package: git-lfs Package: github-mcp-server Package: gitlab-agent-19.2 Package: gitlab-agent-19.3 Package: gitlab-docker-machine-19.3 Package: gitlab-kas-19.2 Package: gitlab-kas-19.3 Package: gitlab-pages-19.2 Package: gitlab-pages-19.3 Package: gitlab-runner-19.3 Package: gitlab-runner-helper-19.3 Package: gitness Package: glow Package: go Package: go-1.25 Package: go-1.25-asm Package: go-1.25-cover Package: go-1.25-doc Package: gogatekeeper Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.26 Package: golang-1.27 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gostatsd Package: gptscript Package: gpu-feature-discovery Package: grafana-13.0 Package: grafana-agent-operator Package: grafana-alloy Package: grafana-image-renderer Package: grafana-mimir-3.1 Package: grafana-mimir-3.1-metaconvert-3.1 Package: grafana-mimir-3.1-mimirtool-3.1 Package: grafana-mimir-3.1-query-tee-3.1 Package: grafana-pyroscope-2.0 Package: grafana-rollout-operator Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: headlamp Package: health-checker-1.35 Package: health-checker-1.36 Package: helm-operator Package: hubble-ui-backend Package: ingress-nginx-controller-1.15 Package: ingress-nginx-custom-error-pages-1.15 Package: istio-cni-1.30 Package: istio-install-cni-1.30 Package: istio-pilot-agent-1.30 Package: istio-pilot-discovery-1.30 Package: istioctl-1.30 Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3d-tools Package: k6 Package: k8s_gateway Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-operator Package: kafka-proxy Package: karpenter-1.11 Package: karpenter-1.12 Package: keda-2.19 Package: keda-2.19-admission-webhooks Package: keda-2.19-metrics-apiserver Package: keda-2.20 Package: keda-2.20-admission-webhooks Package: keda-2.20-metrics-apiserver Package: kind Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-eventing-1.22-channel-controller Package: knative-eventing-1.22-channel-dispatcher Package: knative-eventing-1.22-controller Package: knative-eventing-1.22-filter Package: knative-eventing-1.22-ingress Package: knative-eventing-1.22-jobsink Package: knative-eventing-1.22-mtchannel-broker Package: knative-eventing-1.22-webhook Package: knative-operator-1.21 Package: knative-operator-1.21-webhook Package: knative-operator-1.22 Package: knative-operator-1.22-webhook Package: knative-serving-1.22-activator Package: knative-serving-1.22-autoscaler Package: knative-serving-1.22-autoscaler-hpa Package: knative-serving-1.22-cleanup Package: knative-serving-1.22-controller Package: knative-serving-1.22-queue Package: knative-serving-1.22-webhook Package: kratos Package: kserve-modelmesh-serving Package: kserve-rest-proxy Package: ksops Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-rbac-proxy Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-state-metrics Package: kube-webhook-certgen-1.15 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubeflow-access-management Package: kubeflow-admission-webhook Package: kubeflow-notebook-controller Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubeflow-pvcviewer-controller Package: kubeflow-tensorboard-controller Package: kubelet-1.35 Package: kubelet-1.36 Package: kuberay-operator Package: kuberlr Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-csi-external-resizer Package: kubernetes-csi-external-snapshot-controller-8.5 Package: kubernetes-csi-external-snapshotter-8.5 Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-csi-node-driver-registrar-2.17 Package: kubernetes-dashboard-api Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-event-exporter Package: kubevela-vela-cli Package: kubevela-vela-core Package: kuma-coredns-1.14 Package: kyverno-notation-aws Package: kyverno-policy-reporter Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: lazygit Package: linkerd2-controller Package: linkerd2-metrics-api Package: linkerd2-tap Package: linkerd2-web Package: local-path-provisioner Package: logstash-exporter Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: lvm-driver Package: mailpit Package: malcontent Package: mattermost-11.5 Package: mattermost-11.6 Package: mcp-grafana Package: melange Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metrics-agent Package: minio-operator Package: minio-operator-sidecar Package: mockery Package: mongodb-kubernetes-operator Package: mongodb-kubernetes-operator-readinessprobe Package: mountpoint-s3-csi-driver-2.5 Package: mps-control-daemon Package: nats Package: nats-server Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-fluent-bit-output Package: newrelic-infra-operator Package: newrelic-nri-kube-events Package: newrelic-nri-statsd Package: node-problem-detector-1.35 Package: node-problem-detector-1.36 Package: nri-consul Package: nri-couchbase Package: nri-elasticsearch Package: nri-haproxy Package: nri-kubernetes Package: nri-mssql Package: nri-nginx Package: nri-prometheus Package: nvidia-device-plugin Package: op-geth Package: op-geth-abigen Package: op-geth-clef Package: op-geth-devp2p Package: op-geth-evm Package: openbao Package: opencost Package: opentofu-1.11 Package: osv-scanner Package: pdfcpu Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: pg_timetable Package: pinact Package: pluto Package: policy-controller Package: policy-controller-tester Package: portieris Package: postgres-operator Package: prometheus-3.12 Package: prometheus-adapter Package: prometheus-alertmanager Package: promxy Package: pulumi-kubernetes-operator Package: python-tensorboard Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-system-upgrade-controller Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: rclone Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: renovate Package: rook-1.19 Package: rook-1.19-oci-compat Package: rqlite Package: s5cmd Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: skaffold Package: skopeo Package: slsa-verifier Package: sonobuoy Package: spark-operator Package: speedtest-go Package: spicedb-operator Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: sriov-network-device-plugin Package: stdlib Package: steampipe Package: step Package: step-issuer Package: tekton-pipelines-controller-1.12 Package: tekton-pipelines-controller-1.13 Package: tekton-pipelines-entrypoint-1.12 Package: tekton-pipelines-entrypoint-1.13 Package: tekton-pipelines-events-1.12 Package: tekton-pipelines-events-1.13 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-resolvers-1.13 Package: tekton-pipelines-sidecarlogresults-1.12 Package: tekton-pipelines-sidecarlogresults-1.13 Package: tekton-pipelines-webhook-1.12 Package: tekton-pipelines-webhook-1.13 Package: temporal-ui-server Package: tensorflow Package: terragrunt Package: thanos-operator Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trivy-operator Package: trufflehog Package: trust-manager Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: verticadb-operator Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-updater Package: victoriametrics Package: victoriametrics-vmagent Package: victoriametrics-vmalert Package: victoriametrics-vmauth Package: vitess-24 Package: vitess-24-binaries Package: volume-modifier-for-k8s Package: vt-cli Package: wal-g-pg Package: wgcf Package: whereabouts Package: yace Package: yunikorn-web Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

Affected products

VendorProductAffectedFixed
Go standard library net/http < 1.26.9, 1.27.0-0 – < 1.27.2 1.26.9
Go standard library net/http/httputil < 1.26.9, 1.27.0-0 – < 1.27.2 1.26.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.9-1 —
Debian 14 golang-1.27 1.27.2-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-1.26 +1 No fix yet —
Ubuntu 26.04 LTS golang-1.23 +3 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 24.04 LTS golang-1.22 1.22.2-2ubuntu0.5 USN-8935-1
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 22.04 LTS golang-1.22 1.22.2-2~22.04.4 USN-8935-1
Ubuntu 20.04 LTS golang-1.13 +4 No fix yet —
Ubuntu 20.04 LTS golang-1.22 1.22.2-2~20.04.3 USN-8935-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 golang +7 1.26.10-1.el10_2 RHSA-2026:86093
RHEL 9 golang +7 1.26.10-1.el9_8 RHSA-2026:86196
RHEL 8 delve 1.26.1-1.module+el8.10.0+24516+40554724 RHSA-2026:86203
RHEL 8 golang +7 1.26.10-1.module+el8.10.0+25107+6b50279c RHSA-2026:86203
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS golang +7 1.26.10-1.el10_0 RHSA-2026:87040
RHEL 9.6 EUS golang +7 1.26.10-1.el9_6 RHSA-2026:87043
RHEL 9.4 E4S golang +7 1.26.10-1.el9_4 RHSA-2026:87042
RHEL 9.2 E4S golang +7 1.26.10-1.el9_2 RHSA-2026:87041
RHEL 8.8 TUS delve 1.26.1-1.module+el8.8.0+24781+86ad105d RHSA-2026:87245
RHEL 8.8 TUS golang +7 1.26.10-4.module+el8.8.0+25113+a148ecc0 RHSA-2026:87245
RHEL 8.8 E4S delve 1.26.1-1.module+el8.8.0+24781+86ad105d RHSA-2026:87245
RHEL 8.8 E4S golang +7 1.26.10-4.module+el8.8.0+25113+a148ecc0 RHSA-2026:87245
RHEL 8.6 EUS Long Life delve 1.26.1-1.module+el8.6.0+24782+a062e766 RHSA-2026:87246
RHEL 8.6 EUS Long Life golang +7 1.26.10-4.module+el8.6.0+25114+90ecdb41 RHSA-2026:87246
RHEL 8.6 AUS delve 1.26.1-1.module+el8.6.0+24782+a062e766 RHSA-2026:87246
RHEL 8.6 AUS golang +7 1.26.10-4.module+el8.6.0+25114+90ecdb41 RHSA-2026:87246
RHEL 8.4 EUS Long Life delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c RHSA-2026:90994
RHEL 8.4 EUS Long Life golang +7 1.26.10-2.module+el8.4.0+25201+9a419e96 RHSA-2026:90994
RHEL 8.4 AUS delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c RHSA-2026:90994
RHEL 8.4 AUS golang +7 1.26.10-2.module+el8.4.0+25201+9a419e96 RHSA-2026:90994

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 golang +7 1.26.10-1.el10_2.alma.1 ALSA-2026:86093
AlmaLinux 9 golang +7 1.26.10-1.el9_8 ALSA-2026:86196
AlmaLinux 8 delve 1.26.1-1.module_el8.10.0+4307+6e4cbc60 ALSA-2026:86203
AlmaLinux 8 golang +7 1.26.10-1.module_el8.10.0+4307+6e4cbc60 ALSA-2026:86203

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP7 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP7 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES for SAP 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLES for SAP 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES for SAP 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLE HPC 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLE HPC 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.26 1.26.9-1.1 openSUSE-SU-2026:12093-1
openSUSE Tumbleweed go1.27 1.27.2-1.1 openSUSE-SU-2026:12101-1
openSUSE Tumbleweed rclone 1.75.2-1.1 openSUSE-SU-2026:12112-1
openSUSE Leap 16.0 go1.26 1.26.9-160000.1.1 openSUSE-SU-2026:22095-1
openSUSE Leap 16.0 go1.27 1.27.2-160000.1.1 openSUSE-SU-2026:22093-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +6 1.26.9-1.amzn2023.0.1 ALAS2023-2026-3225
Amazon Linux 2 golang +6 1.26.9-1.amzn2.0.1 ALAS2-2026-4005

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gcc +3 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r79 —
Wolfi rolling actions-runner-controller 0.15.0-r1 —
Wolfi rolling addon-resizer 1.8.24-r7 —
Wolfi rolling apache-exporter 1.1.1-r7 —
Wolfi rolling argo-cd-3.3 +1 3.3.15-r1 —
Wolfi rolling argo-cd-3.4 +1 3.4.10-r1 —
Wolfi rolling argo-workflows-3.7 +1 3.7.18-r10 —
Wolfi rolling argo-workflows-4.0 +1 4.0.12-r2 —
Wolfi rolling atlantis 0.48.1-r1 —
Wolfi rolling authservice 1.1.8-r6 —
Wolfi rolling aws-application-networking-k8s 2.1.3-r5 —
Wolfi rolling aws-flb-cloudwatch 1.9.5-r10 —
Wolfi rolling aws-flb-firehose 1.7.3-r13 —
Wolfi rolling aws-network-policy-agent 1.4.3-r1 —
Wolfi rolling aws-node-termination-handler 1.25.6-r21 —
Wolfi rolling aws-nuke 3.68.3-r1 —
Wolfi rolling aws-otel-collector +1 0.50.0-r6 —
Wolfi rolling azure-service-operator 2.21.1-r2 —
Wolfi rolling azuredisk-csi-1.34 1.34.7-r1 —
Wolfi rolling bank-vaults +1 1.33.2-r5 —
Wolfi rolling blob-csi-1.27 1.27.11-r1 —
Wolfi rolling bom 0.8.0-r2 —
Wolfi rolling calicoctl-3.31 +11 3.31.7-r7 —
Wolfi rolling calicoctl-3.32 +11 3.32.3-r0 —
Wolfi rolling cass-operator 1.32.0-r4 —
Wolfi rolling cert-exporter 2.19.0-r6 —
Wolfi rolling cert-manager-1.20 1.20.4-r3 —
Wolfi rolling cert-manager-cmctl 2.6.1-r3 —
Wolfi rolling cert-manager-istio-csr 0.18.0-r1 —
Wolfi rolling cert-manager-webhook-1.20 +3 1.20.4-r2 —
Wolfi rolling cert-manager-webhook-pdns 2.5.5-r27 —
Wolfi rolling certificate-transparency-trillian-ctserver 1.3.3-r24 —
Wolfi rolling cfssl +5 1.7.1-r1 —
Wolfi rolling chart-testing 3.15.0-r1 —
Wolfi rolling chartmuseum 0.16.6-r9 —
Wolfi rolling cilium-1.19 +4 1.19.8-r3 —
Wolfi rolling cis-operator-1.4 1.4.10-r3 —
Wolfi rolling cloud-provider-aws-1.35-ecr-credential-provider +1 1.35.2-r18 —
Wolfi rolling cloud-provider-aws-1.36-ecr-credential-provider +1 1.36.1-r10 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.36 +1 1.36.7-r1 —
Wolfi rolling cloud-provider-vsphere 1.37.0-r5 —
Wolfi rolling cloud-sql-proxy-2.16 2.16.0-r36 —
Wolfi rolling cloud-sql-proxy-2.21 2.21.3-r18 —
Wolfi rolling cloud-sql-proxy-2.22 2.22.1-r11 —
Wolfi rolling cloud-sql-proxy-2.26 2.26.0-r1 —
Wolfi rolling cloudprober 0.14.6-r1 —
Wolfi rolling cluster-api-1.12-clusterctl +3 1.12.11-r7 —
Wolfi rolling cluster-api-1.13-clusterctl +4 1.13.7-r1 —
Wolfi rolling cluster-api-aws-controller 2.13.1-r1 —
Wolfi rolling cluster-api-gcp-controller 1.13.1-r8 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.1-r2 —
Wolfi rolling cluster-proportional-autoscaler 1.11.0-r2 —
Wolfi rolling cni-plugins-all 1.9.1-r16 —
Wolfi rolling configmap-reload 0.15.0-r21 —
Wolfi rolling confluent-cp-docker-utils 1.0.18-r1 —
Wolfi rolling conftest 0.71.1-r1 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r32 —
Wolfi rolling continuity 0.11.0-r5 —
Wolfi rolling coredns-1.14 +1 1.14.7-r7 —
Wolfi rolling custom-pod-autoscaler-operator 1.4.2-r25 —
Wolfi rolling delve 1.27.2-r1 —
Wolfi rolling dfc-mcp-server 0.10.0-r17 —
Wolfi rolling direnv 2.38.1-r1 —
Wolfi rolling docker-credential-ecr-login 0.12.0-r15 —
Wolfi rolling dockerize +1 0.15.1-r1 —
Wolfi rolling dogstatsd-7.78 +4 7.78.4-r23 —
Wolfi rolling doppler-kubernetes-operator 1.7.2-r1 —
Wolfi rolling emissary +1 4.1.0-r20 —
Wolfi rolling etcd-3.6 3.6.15-r1 —
Wolfi rolling external-dns-0.21 0.21.0-r27 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r25 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r22 —
Wolfi rolling external-secrets-operator-2.6 2.6.0-r15 —
Wolfi rolling falco-no-driver 0.45.0-r4 —
Wolfi rolling falcoctl 0.14.2-r2 —
Wolfi rolling falcosidekick 2.35.0-r7 —
Wolfi rolling filebrowser 2.63.23-r7 —
Wolfi rolling fluent-bit-plugin-loki 3.7.8-r3 —
Wolfi rolling fluent-operator 3.10.1-r2 —
Wolfi rolling flux-2.7 2.7.5-r41 —
Wolfi rolling flux-2.8 2.8.8-r24 —
Wolfi rolling flux-source-controller 1.9.6-r1 —
Wolfi rolling gatus 5.37.0-r2 —
Wolfi rolling gcsfuse 2.12.2-r38 —
Wolfi rolling git-credential-oauth 0.17.2-r14 —
Wolfi rolling git-lfs 3.8.0-r2 —
Wolfi rolling gitlab-kas-19.2 +1 19.2.7-r1 —
Wolfi rolling gitlab-kas-19.3 +1 19.3.3-r1 —
Wolfi rolling gitlab-pages-19.2 19.2.7-r2 —
Wolfi rolling gitlab-pages-19.3 19.3.3-r2 —
Wolfi rolling gitlab-runner-19.3 +2 19.3.3-r3 —
Wolfi rolling gitness 3.3.0-r40 —
Wolfi rolling glow 3.0.0-r5 —
Wolfi rolling go-1.25 +10 No fix yet —
Wolfi rolling gogatekeeper 5.0.0-r2 —
Wolfi rolling gostatsd 28.3.0-r39 —
Wolfi rolling gptscript 0.9.9-r449 —
Wolfi rolling grafana-13.0 13.0.10-r1 —
Wolfi rolling grafana-alloy 1.20.1-r1 —
Wolfi rolling grafana-image-renderer 5.12.6-r0 —
Wolfi rolling grafana-mimir-3.1 +3 3.1.7-r1 —
Wolfi rolling grafana-pyroscope-2.0 2.0.6-r9 —
Wolfi rolling grafana-rollout-operator 0.40.0-r1 —
Wolfi rolling harbor-2.14 +3 2.14.4-r16 —
Wolfi rolling headlamp 0.45.0-r9 —
Wolfi rolling health-checker-1.35 +1 1.35.3-r11 —
Wolfi rolling health-checker-1.36 +1 1.36.0-r12 —
Wolfi rolling helm-operator 1.42.3-r19 —
Wolfi rolling hubble-ui-backend 0.13.6-r1 —
Wolfi rolling ingress-nginx-controller-1.15 1.15.10-r7 —
Wolfi rolling istioctl-1.30 +4 1.30.5-r3 —
Wolfi rolling juicefs-1.3 1.3.3-r10 —
Wolfi rolling k3d +2 5.9.0-r14 —
Wolfi rolling k6 +2 2.3.0-r1 —
Wolfi rolling k8s_gateway 1.8.2-r13 —
Wolfi rolling k8sgpt 0.4.39-r4 —
Wolfi rolling k8ssandra-client 0.9.1-r3 —
Wolfi rolling k8ssandra-operator 1.33.0-r2 —
Wolfi rolling kafka-proxy 0.4.3-r33 —
Wolfi rolling karpenter-1.11 1.11.3-r5 —
Wolfi rolling karpenter-1.12 1.12.2-r6 —
Wolfi rolling keda-2.19 +2 2.19.0-r34 —
Wolfi rolling keda-2.20 +2 2.20.2-r11 —
Wolfi rolling kind 0.33.0-r2 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.4-r12 —
Wolfi rolling knative-eventing-1.22-filter +7 1.22.2-r10 —
Wolfi rolling knative-operator-1.21 +1 1.21.4-r10 —
Wolfi rolling knative-operator-1.22 +1 1.22.3-r10 —
Wolfi rolling knative-serving-1.22-queue +6 1.22.1-r15 —
Wolfi rolling kratos 3.0.0-r6 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r45 —
Wolfi rolling kserve-rest-proxy 0.12.0-r38 —
Wolfi rolling ksops 4.5.1-r19 —
Wolfi rolling kube-arangodb-1.4 1.4.5-r7 —
Wolfi rolling kube-logging-operator +1 6.9.0-r3 —
Wolfi rolling kube-rbac-proxy 0.23.0-r1 —
Wolfi rolling kube-state-metrics 2.20.0-r6 —
Wolfi rolling kube-webhook-certgen-1.15 +1 1.15.10-r8 —
Wolfi rolling kubeadm-1.35 +7 1.35.9-r1 —
Wolfi rolling kubeadm-1.36 +7 1.36.5-r1 —
Wolfi rolling kubeflow-access-management +5 1.10.0-r39 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.17.2-r9 —
Wolfi rolling kuberay-operator 1.7.1-r2 —
Wolfi rolling kuberlr +1 0.8.0-r1 —
Wolfi rolling kubernetes-csi-external-snapshotter-8.5 +1 8.5.0-r31 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r31 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.17 2.17.0-r13 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r22 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.2.2-r36 —
Wolfi rolling kubernetes-event-exporter 1.7-r76 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r18 —
Wolfi rolling kyverno-notation-aws 1.1-r82 —
Wolfi rolling kyverno-policy-reporter 3.11.0-r1 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r36 —
Wolfi rolling kyverno-policy-reporter-ui +7 2.9.0-r1 —
Wolfi rolling lazygit 0.66.0-r1 —
Wolfi rolling linkerd2-tap +3 26.10.1-r1 —
Wolfi rolling local-path-provisioner 0.0.37-r5 —
Wolfi rolling logstash-exporter 1.9.1-r20 —
Wolfi rolling loki-3.6 +3 3.6.17-r4 —
Wolfi rolling lvm-driver 1.10.1-r2 —
Wolfi rolling mailpit 1.31.4-r1 —
Wolfi rolling malcontent 1.27.1-r1 —
Wolfi rolling mattermost-11.5 11.5.7-r14 —
Wolfi rolling mattermost-11.6 11.6.6-r16 —
Wolfi rolling mcp-grafana +1 2.0.2-r1 —
Wolfi rolling melange 0.62.0-r1 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r33 —
Wolfi rolling metacontroller 4.17.2-r4 —
Wolfi rolling metrics-agent 2.14.16-r1 —
Wolfi rolling minio-operator +1 7.1.1-r34 —
Wolfi rolling mockery 3.8.0-r1 —
Wolfi rolling mongodb-kubernetes-operator +1 0.13.0-r29 —
Wolfi rolling mountpoint-s3-csi-driver-2.5 +1 2.5.0-r19 —
Wolfi rolling mps-control-daemon +2 0.20.1-r1 —
Wolfi rolling nats 0.5.0-r1 —
Wolfi rolling nats-server 2.15.1-r0 —
Wolfi rolling neuvector-scanner +1 4.301-r1 —
Wolfi rolling newrelic-fluent-bit-output 3.10.0-r1 —
Wolfi rolling newrelic-infra-operator 1.2.0-r1 —
Wolfi rolling newrelic-nri-kube-events 2.22.1-r1 —
Wolfi rolling newrelic-nri-statsd 2.15.0-r4 —
Wolfi rolling nri-consul 2.11.6-r0 —
Wolfi rolling nri-couchbase 2.12.0-r1 —
Wolfi rolling nri-elasticsearch 6.4.1-r1 —
Wolfi rolling nri-haproxy 3.5.2-r1 —
Wolfi rolling nri-kubernetes 4.8.1-r1 —
Wolfi rolling nri-mssql 2.39.0-r1 —
Wolfi rolling nri-nginx 3.9.1-r1 —
Wolfi rolling nri-prometheus 2.30.5-r1 —
Wolfi rolling op-geth +4 1.101702.3-r5 —
Wolfi rolling openbao 2.7.1-r1 —
Wolfi rolling opencost 1.121.3-r2 —
Wolfi rolling opentofu-1.11 1.11.14-r8 —
Wolfi rolling osv-scanner 2.6.0-r1 —
Wolfi rolling pdfcpu 0.16.1-r1 —
Wolfi rolling percona-server-mongodb-operator +1 1.23.1-r1 —
Wolfi rolling pg_timetable 7.1.0-r5 —
Wolfi rolling pinact 5.0.0-r1 —
Wolfi rolling pluto 5.24.4-r1 —
Wolfi rolling policy-controller +1 0.15.1-r29 —
Wolfi rolling postgres-operator 2.0.3-r2 —
Wolfi rolling prometheus-3.12 3.12.0-r16 —
Wolfi rolling prometheus-adapter 0.12.0-r39 —
Wolfi rolling prometheus-alertmanager 0.34.1-r2 —
Wolfi rolling promxy 0.0.97-r3 —
Wolfi rolling pulumi-kubernetes-operator 2.9.2-r1 —
Wolfi rolling rancher-2.13 +1 2.13.10-r3 —
Wolfi rolling rancher-2.14 2.14.6-r3 —
Wolfi rolling rancher-system-upgrade-controller 0.20.2-r1 —
Wolfi rolling ratify +4 1.4.6-r2 —
Wolfi rolling rclone 1.75.1-r2 —
Wolfi rolling rekor-cli +2 1.5.4-r7 —
Wolfi rolling renovate 44.198.3-r1 —
Wolfi rolling rook-1.19 +1 1.19.11-r1 —
Wolfi rolling rqlite 10.5.3-r1 —
Wolfi rolling s5cmd 2.3.0-r26 —
Wolfi rolling secrets-store-csi-driver 1.6.1-r2 —
Wolfi rolling secrets-store-csi-driver-provider-aws 3.1.4-r2 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.8.2-r11 —
Wolfi rolling skaffold 2.25.0-r4 —
Wolfi rolling skopeo 1.24.1-r2 —
Wolfi rolling slsa-verifier 2.7.1-r35 —
Wolfi rolling sonobuoy 0.57.5-r7 —
Wolfi rolling spark-operator 2.5.2-r7 —
Wolfi rolling speedtest-go 1.8.3-r2 —
Wolfi rolling spicedb-operator 1.27.0-r3 —
Wolfi rolling spire-agent +2 1.15.3-r8 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r24 —
Wolfi rolling steampipe 2.4.7-r3 —
Wolfi rolling step 0.31.0-r2 —
Wolfi rolling step-issuer 0.12.0-r14 —
Wolfi rolling tekton-pipelines-events-1.12 +5 1.12.2-r14 —
Wolfi rolling tekton-pipelines-events-1.13 +4 1.13.1-r11 —
Wolfi rolling tekton-pipelines-webhook-1.13 1.13.1-r12 —
Wolfi rolling temporal-ui-server 2.55.0-r1 —
Wolfi rolling terragrunt 1.1.6-r1 —
Wolfi rolling thanos-operator 0.3.7-r56 —
Wolfi rolling timestamp-authority-cli +1 2.1.4-r1 —
Wolfi rolling tkn 0.46.1-r1 —
Wolfi rolling trillian-logserver +3 1.8.0-r1 —
Wolfi rolling trivy 0.75.0-r2 —
Wolfi rolling trivy-operator 0.35.0-r1 —
Wolfi rolling trufflehog 3.99.2-r1 —
Wolfi rolling trust-manager 0.25.0-r1 —
Wolfi rolling vcluster +2 0.37.3-r1 —
Wolfi rolling verticadb-operator 25.4.0.0-r31 —
Wolfi rolling victoriametrics +3 1.153.0-r1 —
Wolfi rolling vitess-24 +1 24.0.4-r3 —
Wolfi rolling volume-modifier-for-k8s 0.9.6-r1 —
Wolfi rolling vt-cli 1.3.1-r11 —
Wolfi rolling wal-g-pg 3.0.9-r7 —
Wolfi rolling whereabouts 0.9.4-r10 —
Wolfi rolling yace 0.68.0-r1 —
Wolfi rolling yunikorn-web 1.10.0-r1 —
Wolfi rolling zarf 0.87.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.26.9 · >= 1.27.0-0, < 1.27.2 1.26.9, 1.27.2 GO-2026-6605

Advisories 28

References