Skip to content
OpenAdvisories
High · 7.5 CVE-2026-97031 BIT-golang-2026-97031EUVD-2026-95422GHSA-hq7w-2xrq-wp2jGO-2026-6607

Reject malformed ECH outer extension references in crypto/tls

Published Oct 8, 2026 · Updated Oct 9, 2026 · Assigned by Go

Vendor: Go standard library Product: crypto/tls Package: aactl Package: actions-runner-controller Package: addon-resizer Package: apache-exporter Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-workflow-controller-4.0 Package: argo-workflow-executor-3.7 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: atlantis Package: authservice Package: aws-application-networking-k8s Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-network-policy-agent Package: aws-node-termination-handler Package: aws-nuke Package: aws-otel-collector Package: aws-otel-collector-healthcheck Package: azure-service-operator Package: azuredisk-csi-1.34 Package: bank-vaults Package: bank-vaults-template Package: blob-csi-1.27 Package: bom Package: calico-apiserver-3.31 Package: calico-apiserver-3.32 Package: calico-app-policy-3.31 Package: calico-app-policy-3.32 Package: calico-cni-3.31 Package: calico-cni-3.32 Package: calico-felix-3.31 Package: calico-felix-3.32 Package: calico-goldmane-3.31 Package: calico-goldmane-3.32 Package: calico-key-cert-provisioner-3.31 Package: calico-key-cert-provisioner-3.32 Package: calico-kube-controllers-3.31 Package: calico-kube-controllers-3.32 Package: calico-node-3.31 Package: calico-node-3.32 Package: calico-typha-client-3.31 Package: calico-typha-client-3.32 Package: calico-typhad-3.31 Package: calico-typhad-3.32 Package: calico-whisker-backend-3.31 Package: calico-whisker-backend-3.32 Package: calicoctl-3.31 Package: calicoctl-3.32 Package: cass-operator Package: cert-exporter Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cmctl Package: cert-manager-controller-1.20 Package: cert-manager-istio-csr Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cert-manager-webhook-pdns Package: certificate-transparency-trillian-ctserver Package: cfssl Package: cfssl-bundle Package: cfssl-certinfo Package: cfssl-mkbundle Package: cfssl-multirootca Package: cfssl-newkey Package: cfssl-scan Package: chart-testing Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cis-operator-1.4 Package: cloud-provider-aws-1.35-cloud-controller-manager Package: cloud-provider-aws-1.35-ecr-credential-provider Package: cloud-provider-aws-1.36-cloud-controller-manager Package: cloud-provider-aws-1.36-ecr-credential-provider Package: cloud-provider-azure-cloud-controller-manager-1.36 Package: cloud-provider-azure-cloud-node-manager-1.36 Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.21 Package: cloud-sql-proxy-2.22 Package: cloud-sql-proxy-2.26 Package: cloudprober Package: cluster-api-1.12-clusterctl Package: cluster-api-1.12-controller Package: cluster-api-1.12-kubeadm-bootstrap-controller Package: cluster-api-1.12-kubeadm-control-plane-controller Package: cluster-api-1.13-capd-manager Package: cluster-api-1.13-clusterctl Package: cluster-api-1.13-controller Package: cluster-api-1.13-kubeadm-bootstrap-controller Package: cluster-api-1.13-kubeadm-control-plane-controller Package: cluster-api-aws-controller Package: cluster-api-gcp-controller Package: cluster-api-ipam-provider-in-cluster Package: cluster-proportional-autoscaler Package: cni-plugins Package: cni-plugins-all Package: cni-plugins-aws-k8s-compat Package: cni-plugins-dhcp Package: cni-plugins-ipam Package: configmap-reload Package: confluent-cp-docker-utils Package: conftest Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: continuity Package: coredns-1.14 Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-sns Package: custom-pod-autoscaler-operator Package: datadog-agent-7.77 Package: datadog-agent-7.77-fakeintake Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-fakeintake Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: delve Package: dfc-mcp-server Package: direnv Package: docker-credential-ecr-login Package: dockerize Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: doppler-kubernetes-operator Package: emissary Package: emissary-apiext Package: esbuild Package: etcd-3.6 Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: external-secrets-operator-2.6 Package: falco-exporter Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: filebrowser Package: fluent-bit-plugin-loki Package: fluent-operator Package: flux-2.7 Package: flux-2.8 Package: flux-source-controller Package: gatus Package: gcsfuse Package: git-credential-oauth Package: git-lfs Package: github-mcp-server Package: gitlab-agent-19.2 Package: gitlab-agent-19.3 Package: gitlab-docker-machine-19.3 Package: gitlab-kas-19.2 Package: gitlab-kas-19.3 Package: gitlab-pages-19.2 Package: gitlab-pages-19.3 Package: gitlab-runner-19.3 Package: gitlab-runner-helper-19.3 Package: gitness Package: glow Package: go Package: go-1.25 Package: go-1.25-asm Package: go-1.25-cover Package: go-1.25-doc Package: gogatekeeper Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.26 Package: golang-1.27 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gostatsd Package: gptscript Package: gpu-feature-discovery Package: grafana-13.0 Package: grafana-agent-operator Package: grafana-alloy Package: grafana-image-renderer Package: grafana-mimir-3.1 Package: grafana-mimir-3.1-metaconvert-3.1 Package: grafana-mimir-3.1-mimirtool-3.1 Package: grafana-mimir-3.1-query-tee-3.1 Package: grafana-pyroscope-2.0 Package: grafana-rollout-operator Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: headlamp Package: health-checker-1.35 Package: health-checker-1.36 Package: helm-operator Package: http-echo Package: hubble-ui-backend Package: ingress-nginx-controller-1.15 Package: ingress-nginx-custom-error-pages-1.15 Package: istio-cni-1.30 Package: istio-install-cni-1.30 Package: istio-pilot-agent-1.30 Package: istio-pilot-discovery-1.30 Package: istioctl-1.30 Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3d-tools Package: k6 Package: k8s_gateway Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-operator Package: kafka-proxy Package: karpenter-1.11 Package: karpenter-1.12 Package: keda-2.19 Package: keda-2.19-admission-webhooks Package: keda-2.19-metrics-apiserver Package: keda-2.20 Package: keda-2.20-admission-webhooks Package: keda-2.20-metrics-apiserver Package: kind Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-eventing-1.22-channel-controller Package: knative-eventing-1.22-channel-dispatcher Package: knative-eventing-1.22-controller Package: knative-eventing-1.22-filter Package: knative-eventing-1.22-ingress Package: knative-eventing-1.22-jobsink Package: knative-eventing-1.22-mtchannel-broker Package: knative-eventing-1.22-webhook Package: knative-operator-1.21 Package: knative-operator-1.21-webhook Package: knative-operator-1.22 Package: knative-operator-1.22-webhook Package: knative-serving-1.22-activator Package: knative-serving-1.22-autoscaler Package: knative-serving-1.22-autoscaler-hpa Package: knative-serving-1.22-cleanup Package: knative-serving-1.22-controller Package: knative-serving-1.22-queue Package: knative-serving-1.22-webhook Package: kratos Package: kserve-modelmesh-serving Package: kserve-rest-proxy Package: ksops Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-logging-operator-custom-runner Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-rbac-proxy Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-state-metrics Package: kube-webhook-certgen-1.15 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubeflow-access-management Package: kubeflow-admission-webhook Package: kubeflow-notebook-controller Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubeflow-pvcviewer-controller Package: kubeflow-tensorboard-controller Package: kubelet-1.35 Package: kubelet-1.36 Package: kuberay-operator Package: kuberlr Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-csi-external-resizer Package: kubernetes-csi-external-snapshot-controller-8.5 Package: kubernetes-csi-external-snapshotter-8.5 Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-csi-node-driver-registrar-2.17 Package: kubernetes-dashboard-api Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-event-exporter Package: kubernetes-ingress-defaultbackend Package: kubevela-vela-cli Package: kubevela-vela-core Package: kuma-coredns-1.14 Package: kyverno-notation-aws Package: kyverno-policy-reporter Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: lazygit Package: linkerd2-controller Package: linkerd2-metrics-api Package: linkerd2-tap Package: linkerd2-web Package: local-path-provisioner Package: log-counter-1.35 Package: log-counter-1.36 Package: logstash-exporter Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: lvm-driver Package: mailpit Package: malcontent Package: mattermost-11.5 Package: mattermost-11.6 Package: mcp-grafana Package: melange Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metrics-agent Package: minio-operator Package: minio-operator-sidecar Package: mockery Package: mongodb-kubernetes-operator Package: mongodb-kubernetes-operator-readinessprobe Package: mountpoint-s3-csi-driver-2.5 Package: mps-control-daemon Package: nats Package: nats-server Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-fluent-bit-output Package: newrelic-infra-operator Package: newrelic-nri-kube-events Package: newrelic-nri-statsd Package: node-problem-detector-1.35 Package: node-problem-detector-1.36 Package: nri-consul Package: nri-couchbase Package: nri-elasticsearch Package: nri-haproxy Package: nri-kafka Package: nri-kafka-jdk11 Package: nri-kubernetes Package: nri-mongodb Package: nri-mssql Package: nri-nginx Package: nri-postgresql Package: nri-prometheus Package: nvidia-device-plugin Package: op-geth Package: op-geth-abigen Package: op-geth-clef Package: op-geth-devp2p Package: op-geth-evm Package: openbao Package: opencost Package: opentofu-1.11 Package: osv-scanner Package: pdfcpu Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: pg_timetable Package: pg_user Package: pgpool2_exporter Package: php-fpm_exporter Package: pinact Package: pluto Package: policy-controller Package: policy-controller-tester Package: portieris Package: postgres-operator Package: prometheus-3.12 Package: prometheus-adapter Package: prometheus-alertmanager Package: promxy Package: pulumi-kubernetes-operator Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-system-upgrade-controller Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: rclone Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: renovate Package: rook-1.19 Package: rook-1.19-oci-compat Package: rqlite Package: s5cmd Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: skaffold Package: skopeo Package: slsa-verifier Package: sonobuoy Package: spark-operator Package: speedtest-go Package: spicedb-operator Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: sriov-network-device-plugin Package: stdlib Package: steampipe Package: step Package: step-issuer Package: tekton-pipelines-controller-1.12 Package: tekton-pipelines-controller-1.13 Package: tekton-pipelines-entrypoint-1.12 Package: tekton-pipelines-entrypoint-1.13 Package: tekton-pipelines-events-1.12 Package: tekton-pipelines-events-1.13 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-resolvers-1.13 Package: tekton-pipelines-sidecarlogresults-1.12 Package: tekton-pipelines-sidecarlogresults-1.13 Package: tekton-pipelines-webhook-1.12 Package: tekton-pipelines-webhook-1.13 Package: temporal-ui-server Package: terragrunt Package: thanos-operator Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trivy-operator Package: trufflehog Package: trust-manager Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: verticadb-operator Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-updater Package: victoriametrics Package: victoriametrics-vmagent Package: victoriametrics-vmalert Package: victoriametrics-vmauth Package: vitess-24 Package: vitess-24-binaries Package: volume-modifier-for-k8s Package: vt-cli Package: wal-g-pg Package: wgcf Package: whereabouts Package: yace Package: yunikorn-web Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

Affected products

VendorProductAffectedFixed
Go standard library crypto/tls < 1.26.9, 1.27.0-0 – < 1.27.2 1.26.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.9-1 —
Debian 14 golang-1.27 1.27.2-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-1.26 +1 No fix yet —
Ubuntu 26.04 LTS golang-1.23 +3 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +4 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 delve 1.26.1-3.el10_2 ALSA-2026:95519
AlmaLinux 10 golang +7 1.26.10-1.el10_2.alma.1 ALSA-2026:86093
AlmaLinux 10 grafana-pcp 5.3.0-8.el10_2.2 ALSA-2026:88316
AlmaLinux 10 ipp-usb 0.9.27-7.el10_2.4 ALSA-2026:88280
AlmaLinux 10 opentelemetry-collector 0.158.0-2.el10_2 ALSA-2026:93596
AlmaLinux 9 delve 1.26.1-2.el9_8 ALSA-2026:95518
AlmaLinux 9 golang +7 1.26.10-1.el9_8 ALSA-2026:86196
AlmaLinux 9 grafana +1 10.2.6-23.el9_8.7 ALSA-2026:89744
AlmaLinux 9 grafana-pcp 5.1.1-17.el9_8.2 ALSA-2026:88354
AlmaLinux 9 opentelemetry-collector 0.158.0-2.el9_8 ALSA-2026:93617
AlmaLinux 8 delve 1.26.1-1.module_el8.10.0+4307+6e4cbc60 ALSA-2026:86203
AlmaLinux 8 golang +7 1.26.10-1.module_el8.10.0+4307+6e4cbc60 ALSA-2026:86203
AlmaLinux 8 grafana +1 9.2.10-36.el8_10 ALSA-2026:88188
AlmaLinux 8 grafana-pcp 5.1.1-19.el8_10 ALSA-2026:88189

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 delve 1.26.1-3.el10_2 RLSA-2026:95519
Rocky Linux 10 golang 1.26.10-1.el10_2 RLSA-2026:86093
Rocky Linux 10 golang-github-openprinting-ipp-usb 0.9.27-7.el10_2.4 RLSA-2026:88280
Rocky Linux 10 grafana-pcp 5.3.0-8.el10_2.2 RLSA-2026:88316
Rocky Linux 10 opentelemetry-collector 0.158.0-2.el10_2 RLSA-2026:93596
Rocky Linux 9 delve 1.26.1-2.el9_8 RLSA-2026:95518
Rocky Linux 9 golang 1.26.10-1.el9_8 RLSA-2026:86196
Rocky Linux 9 grafana 10.2.6-23.el9_8.7 RLSA-2026:89744
Rocky Linux 9 grafana-pcp 5.1.1-17.el9_8.2 RLSA-2026:88354
Rocky Linux 9 opentelemetry-collector 0.158.0-2.el9_8 RLSA-2026:93617
Rocky Linux 8 delve 1.26.1-1.module+el8.10.0+40244+e7cb3ff8 RLSA-2026:86203
Rocky Linux 8 grafana 9.2.10-36.el8_10 RLSA-2026:88188
Rocky Linux 8 grafana-pcp 5.1.1-19.el8_10 RLSA-2026:88189

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP7 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP7 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES for SAP 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLES for SAP 15 SP6 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP6 go1.26-openssl 1.26.10-150600.13.18.1 SUSE-SU-2026:4866-1
SLES for SAP 15 SP6 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES for SAP 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLES for SAP 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLES 16.0 go1.26 1.26.9-160000.1.1 SUSE-SU-2026:24239-1
SLES 16.0 go1.27 1.27.2-160000.1.1 SUSE-SU-2026:24237-1
SLE HPC 15 SP5 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP5 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP5 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1
SLE HPC 15 SP4 go1.26 1.26.9-150000.1.33.1 SUSE-SU-2026:4629-1
SLE HPC 15 SP4 go1.26-openssl 1.26.10-150000.1.21.2 SUSE-SU-2026:4867-1
SLE HPC 15 SP4 go1.27 1.27.2-150000.1.12.1 SUSE-SU-2026:4625-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.26 1.26.9-1.1 openSUSE-SU-2026:12093-1
openSUSE Tumbleweed go1.27 1.27.2-1.1 openSUSE-SU-2026:12101-1
openSUSE Tumbleweed kyverno 1.19.2-1.1 openSUSE-SU-2026:12214-1
openSUSE Tumbleweed mihomo 1.19.33-1.1 openSUSE-SU-2026:12246-1
openSUSE Tumbleweed rclone 1.75.2-1.1 openSUSE-SU-2026:12112-1
openSUSE Tumbleweed tempo-cli 3.1.1-1.1 openSUSE-SU-2026:12351-1
openSUSE Leap 16.0 go1.26 1.26.9-160000.1.1 openSUSE-SU-2026:22095-1
openSUSE Leap 16.0 go1.27 1.27.2-160000.1.1 openSUSE-SU-2026:22093-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +6 1.26.9-1.amzn2023.0.1 ALAS2023-2026-3225
Amazon Linux 2 golang +6 1.26.9-1.amzn2.0.1 ALAS2-2026-4005

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 delve 1.26.1-3.0.1.el10_2 ELSA-2026-95519
Oracle Linux 10 golang +7 1.26.10-1.0.1.el10_2 ELSA-2026-86093
Oracle Linux 10 grafana +1 10.2.6-28.el10_2.9 ELSA-2026-89751
Oracle Linux 10 grafana-pcp 5.3.0-8.el10_2.2 ELSA-2026-88316
Oracle Linux 10 ipp-usb 0.9.27-7.el10_2.4 ELSA-2026-88280
Oracle Linux 9 delve 1.26.1-2.0.1.el9_8 ELSA-2026-95518
Oracle Linux 9 golang +7 1.26.10-1.0.1.el9_8 ELSA-2026-86196
Oracle Linux 9 grafana +1 10.2.6-23.el9_8.7 ELSA-2026-89744
Oracle Linux 9 grafana-pcp 5.1.1-17.el9_8.2 ELSA-2026-88354
Oracle Linux 8 delve 1.26.1-1.0.1.module+el8.10.0+91008+b9491da4 ELSA-2026-86203
Oracle Linux 8 golang +7 1.26.10-1.0.1.module+el8.10.0+91075+4cd454b9 ELSA-2026-86203
Oracle Linux 8 grafana +1 9.2.10-36.0.1.el8_10 ELSA-2026-88188
Oracle Linux 8 grafana-pcp 5.1.1-19.el8_10 ELSA-2026-88189

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r79 —
Wolfi rolling actions-runner-controller 0.15.0-r1 —
Wolfi rolling addon-resizer 1.8.24-r7 —
Wolfi rolling apache-exporter 1.1.1-r7 —
Wolfi rolling argo-cd-3.3 +1 3.3.15-r1 —
Wolfi rolling argo-cd-3.4 +1 3.4.10-r1 —
Wolfi rolling argo-workflows-3.7 +1 3.7.18-r10 —
Wolfi rolling argo-workflows-4.0 +1 4.0.12-r2 —
Wolfi rolling atlantis 0.48.1-r1 —
Wolfi rolling authservice 1.1.8-r6 —
Wolfi rolling aws-application-networking-k8s 2.1.3-r5 —
Wolfi rolling aws-flb-cloudwatch 1.9.5-r10 —
Wolfi rolling aws-flb-firehose 1.7.3-r13 —
Wolfi rolling aws-network-policy-agent 1.4.3-r1 —
Wolfi rolling aws-node-termination-handler 1.25.6-r21 —
Wolfi rolling aws-nuke 3.68.3-r1 —
Wolfi rolling aws-otel-collector +1 0.50.0-r6 —
Wolfi rolling azure-service-operator 2.21.1-r2 —
Wolfi rolling azuredisk-csi-1.34 1.34.7-r1 —
Wolfi rolling bank-vaults +1 1.33.2-r5 —
Wolfi rolling blob-csi-1.27 1.27.11-r1 —
Wolfi rolling bom 0.8.0-r2 —
Wolfi rolling calicoctl-3.31 +11 3.31.7-r7 —
Wolfi rolling calicoctl-3.32 +11 3.32.3-r0 —
Wolfi rolling cass-operator 1.32.0-r4 —
Wolfi rolling cert-exporter 2.19.0-r6 —
Wolfi rolling cert-manager-1.20 +4 1.20.4-r2 —
Wolfi rolling cert-manager-cmctl 2.6.1-r3 —
Wolfi rolling cert-manager-istio-csr 0.18.0-r1 —
Wolfi rolling cert-manager-webhook-pdns 2.5.5-r27 —
Wolfi rolling certificate-transparency-trillian-ctserver 1.3.3-r24 —
Wolfi rolling cfssl +6 1.7.1-r1 —
Wolfi rolling chart-testing 3.15.0-r1 —
Wolfi rolling chartmuseum 0.16.6-r9 —
Wolfi rolling cilium-1.19 +4 1.19.8-r3 —
Wolfi rolling cis-operator-1.4 1.4.10-r3 —
Wolfi rolling cloud-provider-aws-1.35-ecr-credential-provider +1 1.35.2-r18 —
Wolfi rolling cloud-provider-aws-1.36-ecr-credential-provider +1 1.36.1-r10 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.36 +1 1.36.7-r1 —
Wolfi rolling cloud-provider-vsphere 1.37.0-r5 —
Wolfi rolling cloud-sql-proxy-2.16 2.16.0-r36 —
Wolfi rolling cloud-sql-proxy-2.21 2.21.3-r18 —
Wolfi rolling cloud-sql-proxy-2.22 2.22.1-r11 —
Wolfi rolling cloud-sql-proxy-2.26 2.26.0-r1 —
Wolfi rolling cloudprober 0.14.6-r1 —
Wolfi rolling cluster-api-1.12-clusterctl +3 1.12.11-r7 —
Wolfi rolling cluster-api-1.13-clusterctl +4 1.13.7-r1 —
Wolfi rolling cluster-api-aws-controller 2.13.1-r1 —
Wolfi rolling cluster-api-gcp-controller 1.13.1-r8 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.1-r2 —
Wolfi rolling cluster-proportional-autoscaler 1.11.0-r2 —
Wolfi rolling cni-plugins +4 1.9.1-r16 —
Wolfi rolling configmap-reload 0.15.0-r21 —
Wolfi rolling confluent-cp-docker-utils 1.0.18-r1 —
Wolfi rolling conftest 0.71.1-r1 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r32 —
Wolfi rolling continuity 0.11.0-r5 —
Wolfi rolling coredns-1.14 +1 1.14.7-r7 —
Wolfi rolling custom-pod-autoscaler-operator 1.4.2-r25 —
Wolfi rolling delve 1.27.2-r1 —
Wolfi rolling dfc-mcp-server 0.10.0-r17 —
Wolfi rolling direnv 2.38.1-r1 —
Wolfi rolling docker-credential-ecr-login 0.12.0-r15 —
Wolfi rolling dockerize +1 0.15.1-r1 —
Wolfi rolling dogstatsd-7.78 +4 7.78.4-r23 —
Wolfi rolling doppler-kubernetes-operator 1.7.2-r1 —
Wolfi rolling emissary +1 4.1.0-r20 —
Wolfi rolling esbuild 0.28.2-r7 —
Wolfi rolling etcd-3.6 3.6.15-r1 —
Wolfi rolling external-dns-0.21 0.21.0-r27 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r25 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r22 —
Wolfi rolling external-secrets-operator-2.6 2.6.0-r15 —
Wolfi rolling falco-exporter 0.8.7-r33 —
Wolfi rolling falco-no-driver 0.45.0-r4 —
Wolfi rolling falcoctl 0.14.2-r2 —
Wolfi rolling falcosidekick 2.35.0-r7 —
Wolfi rolling filebrowser 2.63.23-r7 —
Wolfi rolling fluent-bit-plugin-loki 3.7.8-r3 —
Wolfi rolling fluent-operator 3.10.1-r2 —
Wolfi rolling flux-2.7 2.7.5-r41 —
Wolfi rolling flux-2.8 2.8.8-r24 —
Wolfi rolling flux-source-controller 1.9.6-r1 —
Wolfi rolling gatus 5.37.0-r2 —
Wolfi rolling gcsfuse 2.12.2-r38 —
Wolfi rolling git-credential-oauth 0.17.2-r14 —
Wolfi rolling git-lfs 3.8.0-r2 —
Wolfi rolling gitlab-kas-19.2 +1 19.2.7-r1 —
Wolfi rolling gitlab-kas-19.3 +1 19.3.3-r1 —
Wolfi rolling gitlab-pages-19.2 19.2.7-r2 —
Wolfi rolling gitlab-pages-19.3 19.3.3-r2 —
Wolfi rolling gitlab-runner-19.3 +2 19.3.3-r3 —
Wolfi rolling gitness 3.3.0-r40 —
Wolfi rolling glow 3.0.0-r5 —
Wolfi rolling go-1.25 +10 No fix yet —
Wolfi rolling gogatekeeper 5.0.0-r2 —
Wolfi rolling gostatsd 28.3.0-r39 —
Wolfi rolling gptscript 0.9.9-r449 —
Wolfi rolling grafana-13.0 13.0.10-r1 —
Wolfi rolling grafana-alloy 1.20.1-r1 —
Wolfi rolling grafana-image-renderer 5.12.6-r0 —
Wolfi rolling grafana-mimir-3.1 +3 3.1.7-r1 —
Wolfi rolling grafana-pyroscope-2.0 2.0.6-r9 —
Wolfi rolling grafana-rollout-operator 0.40.0-r1 —
Wolfi rolling harbor-2.14 +3 2.14.4-r16 —
Wolfi rolling headlamp 0.45.0-r9 —
Wolfi rolling helm-operator 1.42.3-r19 —
Wolfi rolling http-echo 1.0.0-r36 —
Wolfi rolling hubble-ui-backend 0.13.6-r1 —
Wolfi rolling ingress-nginx-controller-1.15 1.15.10-r7 —
Wolfi rolling istioctl-1.30 +4 1.30.5-r3 —
Wolfi rolling juicefs-1.3 1.3.3-r10 —
Wolfi rolling k3d +2 5.9.0-r14 —
Wolfi rolling k6 +2 2.3.0-r1 —
Wolfi rolling k8s_gateway 1.8.2-r13 —
Wolfi rolling k8sgpt 0.4.39-r4 —
Wolfi rolling k8ssandra-client 0.9.1-r3 —
Wolfi rolling k8ssandra-operator 1.33.0-r2 —
Wolfi rolling kafka-proxy 0.4.3-r33 —
Wolfi rolling karpenter-1.11 1.11.3-r5 —
Wolfi rolling karpenter-1.12 1.12.2-r6 —
Wolfi rolling keda-2.19 +2 2.19.0-r34 —
Wolfi rolling keda-2.20 +2 2.20.2-r11 —
Wolfi rolling kind 0.33.0-r2 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.4-r12 —
Wolfi rolling knative-eventing-1.22-filter +7 1.22.2-r10 —
Wolfi rolling knative-operator-1.21 +1 1.21.4-r10 —
Wolfi rolling knative-operator-1.22 +1 1.22.3-r10 —
Wolfi rolling knative-serving-1.22-queue +6 1.22.1-r15 —
Wolfi rolling kratos 3.0.0-r6 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r45 —
Wolfi rolling kserve-rest-proxy 0.12.0-r38 —
Wolfi rolling ksops 4.5.1-r19 —
Wolfi rolling kube-arangodb-1.4 1.4.5-r7 —
Wolfi rolling kube-logging-operator +1 6.9.0-r3 —
Wolfi rolling kube-logging-operator-custom-runner 1.0.0-r4 —
Wolfi rolling kube-rbac-proxy 0.23.0-r1 —
Wolfi rolling kube-state-metrics 2.20.0-r6 —
Wolfi rolling kube-webhook-certgen-1.15 +1 1.15.10-r8 —
Wolfi rolling kubeadm-1.35 +7 1.35.9-r1 —
Wolfi rolling kubeadm-1.36 +7 1.36.5-r1 —
Wolfi rolling kubeflow-access-management +5 1.10.0-r39 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.17.2-r9 —
Wolfi rolling kuberay-operator 1.7.1-r2 —
Wolfi rolling kuberlr +1 0.8.0-r1 —
Wolfi rolling kubernetes-csi-external-snapshotter-8.5 +1 8.5.0-r31 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r31 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.17 2.17.0-r13 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r22 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.2.2-r36 —
Wolfi rolling kubernetes-event-exporter 1.7-r76 —
Wolfi rolling kubernetes-ingress-defaultbackend 1.43.0-r1 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r18 —
Wolfi rolling kyverno-notation-aws 1.1-r82 —
Wolfi rolling kyverno-policy-reporter 3.11.0-r1 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r36 —
Wolfi rolling kyverno-policy-reporter-ui +7 2.9.0-r1 —
Wolfi rolling lazygit 0.66.0-r1 —
Wolfi rolling linkerd2-tap +3 26.10.1-r1 —
Wolfi rolling local-path-provisioner 0.0.37-r5 —
Wolfi rolling log-counter-1.35 +2 1.35.3-r11 —
Wolfi rolling log-counter-1.36 +2 1.36.0-r12 —
Wolfi rolling logstash-exporter 1.9.1-r20 —
Wolfi rolling loki-3.6 +3 3.6.17-r4 —
Wolfi rolling lvm-driver 1.10.1-r2 —
Wolfi rolling mailpit 1.31.4-r1 —
Wolfi rolling malcontent 1.27.1-r1 —
Wolfi rolling mattermost-11.5 11.5.7-r14 —
Wolfi rolling mattermost-11.6 11.6.6-r16 —
Wolfi rolling mcp-grafana +1 2.0.2-r1 —
Wolfi rolling melange 0.62.0-r1 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r33 —
Wolfi rolling metacontroller 4.17.2-r4 —
Wolfi rolling metrics-agent 2.14.16-r1 —
Wolfi rolling minio-operator +1 7.1.1-r34 —
Wolfi rolling mockery 3.8.0-r1 —
Wolfi rolling mongodb-kubernetes-operator +1 0.13.0-r29 —
Wolfi rolling mountpoint-s3-csi-driver-2.5 +1 2.5.0-r19 —
Wolfi rolling mps-control-daemon +2 0.20.1-r1 —
Wolfi rolling nats 0.5.0-r1 —
Wolfi rolling nats-server 2.15.1-r0 —
Wolfi rolling neuvector-scanner +1 4.301-r1 —
Wolfi rolling newrelic-fluent-bit-output 3.10.0-r1 —
Wolfi rolling newrelic-infra-operator 1.2.0-r1 —
Wolfi rolling newrelic-nri-kube-events 2.22.1-r1 —
Wolfi rolling newrelic-nri-statsd 2.15.0-r4 —
Wolfi rolling nri-consul 2.11.6-r0 —
Wolfi rolling nri-couchbase 2.12.0-r1 —
Wolfi rolling nri-elasticsearch 6.4.1-r1 —
Wolfi rolling nri-haproxy 3.5.2-r1 —
Wolfi rolling nri-kafka +1 3.27.0-r1 —
Wolfi rolling nri-kubernetes 4.8.1-r1 —
Wolfi rolling nri-mongodb 2.15.1-r2 —
Wolfi rolling nri-mssql 2.39.0-r1 —
Wolfi rolling nri-nginx 3.9.1-r1 —
Wolfi rolling nri-postgresql 2.32.0-r1 —
Wolfi rolling nri-prometheus 2.30.5-r1 —
Wolfi rolling op-geth +4 1.101702.3-r5 —
Wolfi rolling openbao 2.7.1-r1 —
Wolfi rolling opencost 1.121.3-r2 —
Wolfi rolling opentofu-1.11 1.11.14-r8 —
Wolfi rolling osv-scanner 2.6.0-r1 —
Wolfi rolling pdfcpu 0.16.1-r1 —
Wolfi rolling percona-server-mongodb-operator +1 1.23.1-r1 —
Wolfi rolling pg_timetable 7.1.0-r5 —
Wolfi rolling pg_user 1.1.1-r22 —
Wolfi rolling pgpool2_exporter 1.2.2-r31 —
Wolfi rolling php-fpm_exporter 2.2.0-r38 —
Wolfi rolling pinact 5.0.0-r1 —
Wolfi rolling pluto 5.24.4-r1 —
Wolfi rolling policy-controller +1 0.15.1-r29 —
Wolfi rolling postgres-operator 2.0.3-r2 —
Wolfi rolling prometheus-3.12 3.12.0-r16 —
Wolfi rolling prometheus-adapter 0.12.0-r39 —
Wolfi rolling prometheus-alertmanager 0.34.1-r2 —
Wolfi rolling promxy 0.0.97-r3 —
Wolfi rolling pulumi-kubernetes-operator 2.9.2-r1 —
Wolfi rolling rancher-2.13 +1 2.13.10-r3 —
Wolfi rolling rancher-2.14 2.14.6-r3 —
Wolfi rolling rancher-system-upgrade-controller 0.20.2-r1 —
Wolfi rolling ratify +4 1.4.6-r2 —
Wolfi rolling rclone 1.75.1-r2 —
Wolfi rolling rekor-cli +2 1.5.4-r7 —
Wolfi rolling renovate 44.198.3-r1 —
Wolfi rolling rook-1.19 +1 1.19.11-r1 —
Wolfi rolling rqlite 10.5.3-r1 —
Wolfi rolling s5cmd 2.3.0-r26 —
Wolfi rolling secrets-store-csi-driver 1.6.1-r2 —
Wolfi rolling secrets-store-csi-driver-provider-aws 3.1.4-r2 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.8.2-r11 —
Wolfi rolling skaffold 2.25.0-r4 —
Wolfi rolling skopeo 1.24.1-r2 —
Wolfi rolling slsa-verifier 2.7.1-r35 —
Wolfi rolling sonobuoy 0.57.5-r7 —
Wolfi rolling spark-operator 2.5.2-r7 —
Wolfi rolling speedtest-go 1.8.3-r2 —
Wolfi rolling spicedb-operator 1.27.0-r3 —
Wolfi rolling spire-agent +2 1.15.3-r8 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r24 —
Wolfi rolling steampipe 2.4.7-r3 —
Wolfi rolling step 0.31.0-r2 —
Wolfi rolling step-issuer 0.12.0-r14 —
Wolfi rolling tekton-pipelines-events-1.12 +5 1.12.2-r14 —
Wolfi rolling tekton-pipelines-events-1.13 +4 1.13.1-r11 —
Wolfi rolling tekton-pipelines-webhook-1.13 1.13.1-r12 —
Wolfi rolling temporal-ui-server 2.55.0-r1 —
Wolfi rolling terragrunt 1.1.6-r1 —
Wolfi rolling thanos-operator 0.3.7-r56 —
Wolfi rolling timestamp-authority-cli +1 2.1.4-r1 —
Wolfi rolling tkn 0.46.1-r1 —
Wolfi rolling trillian-logserver +3 1.8.0-r1 —
Wolfi rolling trivy 0.75.0-r2 —
Wolfi rolling trivy-operator 0.35.0-r1 —
Wolfi rolling trufflehog 3.99.2-r1 —
Wolfi rolling trust-manager 0.25.0-r1 —
Wolfi rolling vcluster +2 0.37.3-r1 —
Wolfi rolling verticadb-operator 25.4.0.0-r31 —
Wolfi rolling victoriametrics +3 1.153.0-r1 —
Wolfi rolling vitess-24 +1 24.0.4-r3 —
Wolfi rolling volume-modifier-for-k8s 0.9.6-r1 —
Wolfi rolling vt-cli 1.3.1-r11 —
Wolfi rolling wal-g-pg 3.0.9-r7 —
Wolfi rolling whereabouts 0.9.4-r10 —
Wolfi rolling yace 0.68.0-r1 —
Wolfi rolling yunikorn-web 1.10.0-r1 —
Wolfi rolling zarf 0.87.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.26.9 · >= 1.27.0-0, < 1.27.2 1.26.9, 1.27.2 GO-2026-6607

Advisories 50

References