include 5 security fixes following the security policy : - crypto/x509: incorrect enforcement of email constraints When verifying a certificate chain which contains a certificate

include PRIVATE security fixes to the standard > library, covering the following CVEs: > > - CVE-2026-27137 > - CVE-2026-27138 > - CVE-2026-25679 > - CVE-2026

includes 1 security fix following the security policy : - crypto/tls: unexpected session resumption when using Config.GetConfigForClient Config.GetConfigForClient is documented

include 2 security fixes following the security policy : - cmd/cgo: remove user-content from doc strings in cgo ASTs A discrepancy between how Go and C/C++ comments were parsed allowed

includes 6 security fixes following the security policy : - archive/zip: denial of service when parsing arbitrary ZIP archives archive/zip used a super-linear file name indexing

include 6 security fixes following the security policy : - archive/zip: denial of service when parsing arbitrary ZIP archives archive/zip used a super-linear file name indexing

include PRIVATE security fixes to the standard library and the toolchain, covering the following CVEs: - CVE-2025-61728 - CVE-2025-61726 - CVE-2025-68121 - CVE-2025-61731 - CVE

address a security issue. This release fixes unexpected behavior when operating in Restricted Mode. To prevent accidental untrusted code execution, the extension is now disabled

include 2 security fixes following the security policy : - crypto/x509: excessive resource consumption in printing error string for host certificate validation Within HostnameError

include PRIVATE security fixes to the standard library, covering the following CVE: - CVE-2025-61729 Following our security policy, this is the pre-announcement of those releases

address two security issues. This version fixes a vulnerability in the golang.org/x/crypto/ssh package and a vulnerability in the golang.org/x/crypto/ssh/agent package which

issue a security fix for the packages golang.org/x/crypto/ssh and golang.org/x/crypto/ssh/agent in the golang.org/x/crypto module during US business hours on Wednesday, November

by a security patch included in Go 1.25.2 and 1.24.8, which enforced overly restrictive validation on the parsing of X.509 certificates. We've removed those restrictions while

address two security issues. This version fixes two vulnerabilities in the golang.org/x/net/html package which could result in calls to Parse (and associated functions) executing

include 10 security fixes following the security policy : - net/mail: excessive CPU consumption in ParseAddress The ParseAddress function constructed domain-literal address

issue a security fix for the package golang.org/x/net/html in the golang.org/x/net module during US business hours on Tuesday, October 7. This will cover the following CVEs: - CVE

include PRIVATE security fixes to the standard library, covering the following CVEs: - CVE-2025-61724 - CVE-2025-61725 - CVE-2025-58187 - CVE-2025-61723 - CVE-2025-47912 - CVE

include 1 security fixes following the security policy : - net/http: CrossOriginProtection bypass patterns are over-broad When passing patterns to CrossOriginProtection.AddInsecureBypassPattern

includes 2 security fixes following the security policy : - os/exec: LookPath may return unexpected paths If the PATH environment variable contains paths which are executables (

include 2 security fixes following the security policy : - os/exec: LookPath may return unexpected paths If the PATH environment variable contains paths which are executables (rather

include PRIVATE security fixes to the standard library, covering the following CVE: - CVE-2025-47907 Following our security policy, this is the pre-announcement of those releases

includes 1 security fix following the security policy : - cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories

include 1 security fixes following the security policy : - cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories

include PRIVATE security fixes to the toolchain, covering the following CVE: - CVE-2025-4674 Following our security policy, this is the pre-announcement of those releases. Thanks

include 3 security fixes following the security policy : - net/http: sensitive headers not cleared on cross-origin redirect Proxy-Authorization and Proxy-Authenticate headers

a PRIVATE security fix. The others are PUBLIC. On Friday, May 30, 2025 at 12:19:51 PM UTC-4 anno...@golang.org wrote: > Hello gophers, > > We plan to issue Go 1.24.4 and Go 1.23

includes 1 security fix following the security policy : - os: Root permits access to parent directory It was possible to improperly access the parent directory of an os.Root by opening

include PRIVATE security fixes to the standard library, covering the following CVE: - CVE-2025-22873 Following our security policy, this is the pre-announcement of those releases

include 1 security fixes following the security policy : - net/http: request smuggling through invalid chunked data The net/http package accepted data in the chunked transfer encoding

address a security issue. This version fixes a vulnerability in the golang.org/x/net/html package which could result in the tokenizer emitting incorrect tokens and the parser producing