Go - OSV

GO-2026-6599

Go/stdlib

Reset context tracking on consecutive template expressions in html/template 08 Oct

Fix available

GO-2026-6600

Go/stdlib

Recognize yield as regexp preceder keyword in html/template 08 Oct

Fix available

GO-2026-6603

Go/golang.org/x/net
Go/stdlib

HTTP/2 server memory exhaustion due to Trailer headers in net/http 08 Oct

Fix available

GO-2026-6604

Go/stdlib

Root.Mkdir(All) can follow junctions out of the root on Windows in os 08 Oct

Fix available

GO-2026-6605

Go/stdlib

HTTP/1 client connection desynchronization after CONNECT rejection in net/http 08 Oct

Fix available

GO-2026-6607

Go/stdlib

Reject malformed ECH outer extension references in crypto/tls 08 Oct

Fix available

GO-2026-6608

Go/stdlib

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart 08 Oct

Fix available

GO-2026-6609

Go/stdlib

Lack of limit on size of parsed Range headers in net/http 08 Oct

Fix available

GO-2026-6610

Go/golang.org/x/net
Go/stdlib

HTTP/2 transport accepts malformed framing-related headers in net/http 08 Oct

Fix available

GO-2026-6611

Go/golang.org/x/net
Go/stdlib

Excessive CPU consumption from repeated initial window changes in net/http 08 Oct

Fix available

GO-2026-6612

Go/golang.org/x/net
Go/stdlib

Double flow control refund on HTTP/2 server streams in net/http 08 Oct

Fix available

GO-2026-6613

Go/stdlib

HTTP/1 server connection desynchronization after 2xx CONNECT response in... 08 Oct

Fix available

GO-2026-6617

Go/golang.org/x/net
Go/stdlib

HTTP/2 server crash due to HPACK encoder race in net/http 08 Oct

Fix available

GO-2026-5972

Go/stdlib

Enforce maximum recursion depth in encoding/asn1 13 Aug

Fix available

GO-2026-6088

Go/stdlib

Add recursion depth guard during decode in encoding/xml 13 Aug

Fix available

GO-2026-6089

Go/stdlib

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 13 Aug

Fix available

Vulnerabilities