[security] Go 1.27 Release Candidate 2 is released

[anno...@golang.org]

Hello gophers,

We have just released go1.27rc2, a release candidate version of Go 1.27.
It is cut from release-branch.go1.27 at the revision tagged go1.27rc2.

This release includes 2 security fixes following the security policy:

• os: Root escape via symlink plus trailing slash

  On Unix systems, opening a file in an os.Root improperly
  followed symlinks to locations outside of the Root when
  the final path component of the a path is a symbolic link
  and the path ends in /.

  For example, root.Open("symlink/") would open "symlink"
  even when "symlink" is a symbolic link pointing outside of the root.

  On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
  in path when path ends in a /. Root failed to account for
  this behavior, permitting paths with a trailing / to escape.
  It now properly sanitizes the path parameter provided to openat.

  Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.

  This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

• crypto/tls: Encrypted Client Hello privacy leak

  The Encrypted Client Hello implementation would leak the pre-shared key
  identities during the handshake, allowing a passive network observer who can
  collect handshakes to de-anonymize the hostname of the server, even when ECH was
  being used.

  Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

  This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

Please try your production load tests and unit tests with the new version.
Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

Please consider opting in to Go telemetry if you haven't already.
Go telemetry helps validate this release candidate and future Go releases.
You can opt in by running the following command:

$ go telemetry on

If you have Go installed already, an easy way to try go1.27rc2
is by using the go command:

$ go install golang.org/dl/go1.27rc2@latest
$ go1.27rc2 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.27rc2

To find out what has changed in Go 1.27, read the draft release notes:
https://tip.golang.org/doc/go1.27

Cheers,
Junyang and David for the Go team