Loading story…
The Go project released Go 1.26.4 and Go 1.25.11 with three security fixes, including two denial-of-service issues that could be triggered by crafted input. One flaw, tracked as CVE-2026-42504, affects mime.WordDecoder.DecodeHeader, where malicious MIME headers containing many invalid encoded words can drive quadratic or near-quadratic parsing behavior and cause excessive CPU consumption. Public issue details describe an attack pattern using repeated malformed encoded-word prefixes that force repeated parsing work before a terminating ?= sequence.
The same releases also fix CVE-2026-27145, a quadratic-performance problem in crypto/x509 hostname verification when certificates contain large DNS SAN lists, and CVE-2026-42507, where net/textproto functions could return unescaped attacker-controlled input in error messages, creating a risk of misleading log entries or terminal control-sequence injection. The Go team credited p4p3r and Jakub Ciolek for reporting two of the issues and directed users to upgrade to the patched versions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Go team released Go 1.26.4 and Go 1.25.11 as minor point releases containing three security fixes. The fixes addressed CVE-2026-42504 in mime, CVE-2026-42507 in net/textproto, and CVE-2026-27145 in crypto/x509.
A public Go security issue tracking quadratic or near-quadratic complexity in mime.WordDecoder.DecodeHeader was opened, documenting that malicious MIME header input could trigger excessive parsing work. The issue credits p4p3r for reporting it and assigns CVE-2026-42504.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegroups.google.com
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2026-32283**, an Important denial-of-service flaw in `crypto/tls` that can deadlock TLS 1.3 connections when a peer sends multiple post-handshake key update messages in a single record, leading to uncontrolled resource consumption. Go also disclosed **CVE-2026-27144** in `cmd/compile`, where a no-op interface conversion could bypass overlap checks for memory moves, creating conditions for unsafe overlapping copies and possible memory corruption or unexpected behavior at runtime. Red Hat subsequently shipped fixes for these Go flaws across multiple RHEL 8, 9, and 10 channels and dependent packages including **golang**, **rhc**, **ipp-usb**, **gvisor-tap-vsock**, and **Cryostat 4**, often alongside other Go vulnerabilities in `crypto/x509` and `internal/syscall/unix`. Advisories rated the updates **Important**, with `CVE-2026-32283` scored **CVSS 7.5** by Red Hat, and updated package builds were released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x` across standard, EUS, AUS, SAP, and Extended Life Cycle offerings.
Aug 20, 2026
The Go Project disclosed **CVE-2025-61726**, a denial-of-service flaw in the standard library's `net/url` handling that can be triggered through `net/http.Request.ParseForm`. The bug stems from the lack of a limit on query parameter counts, allowing attackers to submit URL-encoded forms with many unique parameters and drive excessive memory consumption. The issue affects Go releases before **1.24.12** and **1.25.x before 1.25.6**, and is tracked in Go issue `#77101` and Go advisory **GO-2026-4341**. Red Hat subsequently shipped **Important** security updates for multiple products bundling vulnerable Go components, most notably **grafana-pcp** across RHEL 8, RHEL 9, and RHEL 10 channels, as well as **golang-github-openprinting-ipp-usb** on RHEL 10. Several advisories bundled fixes for related Go flaws, including **CVE-2025-61729** in `crypto/x509` and **CVE-2025-68121` in `crypto/tls`, with updated packages released for `x86_64`, `aarch64`, `ppc64le`, and `s390x` architectures across standard, SAP, AUS, EUS, and Extended Life Cycle offerings.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026