oss-security - Fwd: Go 1.26.4 and Go 1.25.11 are released

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <49b7d391-1637-4b30-8330-7fa88028802e@oracle.com>
Date: Tue, 2 Jun 2026 18:06:02 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: Go 1.26.4 and Go 1.25.11 are released




-------- Forwarded Message --------
Subject: 	[security] Go 1.26.4 and Go 1.25.11 are released
Date: 	Tue, 2 Jun 2026 21:11:30 +0000
From: 	announce@...ang.org
To: 	golang-nuts@...glegroups.com



Hello gophers,

We have just released Go versions 1.26.4 and 1.25.11, minor point releases.

These releases include 3 security fixes following the security policy <https://go.dev/doc/security/policy>:

   * mime: quadratic complexity in WordDecoder.DecodeHeader

     Decoding a maliciously-crafted MIME header containing many invalid
     encoded-words could consume excessive CPU.
     The MIME decoder now better handles this case.

     Thanks to p4p3r (<https://hackerone.com/p4p3r_hak>) for reporting this issue.

     This is CVE-2026-42504 and Go issue https://go.dev/issue/79217

   * net/textproto: arbitrary input are included in errors without any escaping

     When returning errors, functions in the net/textproto package would
     include its input as part of the error, without any escaping. Note that
     said input is often controlled by external parties when using this
     package naturally. For example, a net/http client uses ReadMIMEHeader
     when parsing the headers it receive from a server.

     As a result, an attacker could inject arbitrary content into the error.
     Practically, this can result in an attacker injecting misleading
     content, terminal control bytes, etc. into a victim's output or logs.

     This is CVE-2026-42507 and Go issue https://go.dev/issue/79346

   * crypto/x509: split candidate hostname only once

     (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
     over all DNS Subject Alternative Name (SAN) entries. This caused
     strings.Split(host, ".") to execute repeatedly on the same input hostname.

     With a large DNS SAN list, verification costs scaled quadratically based on the
     number of SAN entries multiplied by the hostname's label count. Because
     x509.Verify validates hostnames before building the certificate chain, this
     overhead occurred even for untrusted certificates.

     Thanks to Jakub Ciolek (<https://ciolek.dev>) for reporting this issue.

     This is CVE-2026-27145 and https://go.dev/issue/79694

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
|git checkout go1.26.4| and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
The Go team

-- 
You received this message because you are subscribed to the Google Groups "golang-announce" group.
To view this discussion visit https://groups.google.com/d/msgid/golang-announce/b412db1a.BAAACMDeKCEAAAAAAAAAA-p9MGAAAYKKSQYAAAAAADE8OwBqH0cC%40mailjet.com

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.