On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
CVE-2026-97031 is a high-severity vulnerability in the Go standard library's crypto/tls package. It involves improper handling of multiple Encrypted Client Hello (ECH) outer extension references, which are disallowed by RFC 9849. A malicious client could send a crafted packet with multiple references, causing memory exhaustion on the server. The issue has been addressed by rejecting such malformed packets, mitigating the memory amplification risk.
CVE-2026-94440 is a high-severity vulnerability in the Go standard library net/textproto package. It involves allocation of resources without limits or throttling when parsing multipart forms. Specifically, the vulnerability allows bypassing memory limits and reading an arbitrarily long line into memory if the remaining limit at the start of a part is less than 400 bytes. This can lead to excessive memory consumption and potential denial of service.
CVE-2026-94439 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent handling of HTTP/1 CONNECT requests. When a server handler sends a 2xx response to such a request but does not hijack the connection, it incorrectly continues to process the connection as HTTP rather than as a tunnel. This behavior can lead to HTTP request smuggling, where intermediaries and the server have differing interpretations of the connection data.
CVE-2026-78660 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP requests, leading to HTTP response smuggling. The issue arises because the HTTP/2 implementation in net/http is lax about malformed framing-related headers, which can be forwarded to HTTP/1 clients when acting as a reverse proxy. If the HTTP/1 client also does not strictly validate these headers, response smuggling can occur.
CVE-2026-78659 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption through the handling of "Trailer" headers in HTTP/2 servers. A malicious client can send a "Trailer" header declaring many fields, causing excessive memory allocation by the server. This bypasses existing limits on header size and count, leading to potential denial-of-service conditions. The issue does not affect HTTP/1 servers due to different header handling and lack of multiplexing. No known exploits are reported in the wild. Affected versions include multiple pre-1.26.9 and pre-1.27.2 releases, as well as versions before 0.60.0. No patch or official fix information is provided in the input data.
CVE-2026-56866 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP/1 CONNECT requests with non-empty bodies. When http.Transport sends such a CONNECT request, it writes the body without framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool while the server may interpret trailing body bytes as a new pipelined HTTP/1.1 request. This desynchronization can cause response poisoning in reverse proxies that share the Transport, leading to cross-user response contamination.
CVE-2026-56857 is a critical vulnerability in the Go standard library's os package affecting Windows systems. It involves insecure operations on Windows junctions or mount points during directory creation with Root.Mkdir or Root.MkdirAll. Specifically, when the last path component is a junction pointing to an empty location, these functions can create directories at the junction target even if it lies outside the intended root directory. This behavior can lead to unauthorized directory creation outside the expected path boundaries.
CVE-2026-78669 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption (amplification) via HTTP/2 where a malicious peer can cause excessive CPU usage by opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. This can impact both clients and servers using the affected versions of the net/http package.
CVE-2026-78663 is a critical vulnerability in the Go standard library net/http package affecting HTTP/2 servers. It allows a malicious client to bypass the configured connection-level flow control limit by causing the server to refund flow control credits twice for the same data. This occurs when a client resets a stream and the request handler subsequently reads buffered data, resulting in double refunding of connection-level flow control. Although total buffered data remains limited by concurrent stream limits and stream-level flow control, this flaw can lead to denial of service or resource exhaustion.
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
CVE-2026-97030 is a cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It involves improper escaping of the 'yield' keyword in templates, where valid uses were not correctly escaped, potentially allowing injection of malicious scripts. The issue affects certain versions of the Go html/template package prior to 1.26.9 and between 1.27.0-0 and 1.27.2. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-94448 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises when JavaScript template literals contain consecutive expressions, causing improper context tracking and failure to reset state correctly. This flaw can lead to insufficient escaping of regular expression literals within templates, potentially allowing injection of malicious scripts.
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
CVE-2026-56853 is a high-severity vulnerability in the Go standard library net/http package. It occurs when a server supports unencrypted HTTP/2 and reads initial bytes from new connections to detect the HTTP/2 client preface. During this process, the ReadHeaderTimeout setting is not applied as expected, leading to allocation of resources without proper limits or throttling. This can cause denial of service by exhausting server resources.