Go HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfault#golang
Go 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueGo sum types proposal weighs union syntax and safe access
A non-interface union design for closed variant sets is under active review, including soft-keyword experiments and type-inference trade-offs.
By rvalueGo x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultGo patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultGo x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultGo 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfault