USN-8935-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8935-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8935-1
Upstream
CVE (12)
Related
UBUNTU (12)
Published
2026-10-19T11:40:22Z
Modified
2026-10-19T23:43:23Z
Summary
golang-1.22 vulnerabilities
Details

It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. (CVE-2026-33818)

It was discovered that Go incorrectly reset the depth counter when decoding XML elements. An attacker could possibly use this issue to cause Go to crash via deeply nested XML input, resulting in a denial of service. (CVE-2026-56859)

It was discovered that Go incorrectly handled TLS KeyUpdate messages after the handshake was completed. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-56862)

It was discovered that Go did not correctly verify checksum database tiles against their parents. An attacker in control of a malicious module proxy could possibly use this issue to bypass checksum database verification and serve malicious module content. (CVE-2026-56865)

It was discovered that the Go HTTP client incorrectly returned connections to the idle pool after a rejected HTTP/1 CONNECT request with a request body. A remote attacker could possibly use this issue to perform HTTP response poisoning attacks against reverse proxies. (CVE-2026-56866)

It was discovered that the Go HTTP/2 server did not apply header limits to Trailer headers. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78659)

It was discovered that the Go HTTP/2 implementation did not remove malformed framing-related headers when forwarding responses. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks when Go was acting as a reverse proxy. (CVE-2026-78660)

It was discovered that the Go HTTP/2 server could refund connection-level flow control twice for the same data under certain circumstances. A remote attacker could possibly use this issue to bypass the configured connection-level flow control limit. (CVE-2026-78663)

It was discovered that Go did not limit the size of Range headers parsed when serving content over HTTP. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78667)

It was discovered that the Go HTTP/2 implementation incorrectly handled SETTINGS frames that changed the initial window size. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78669)

It was discovered that the Go HTTP server continued to serve requests on a connection after sending a successful response to an HTTP/1 CONNECT request. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-94439)

It was discovered that Go did not enforce memory limits on the first line of a part when parsing multipart forms. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-94440)

References

Affected packages

Ubuntu:20.04:LTS / golang-1.22

Package

Name
golang-1.22
Purl
pkg:deb/ubuntu/golang-1.22?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.22.2-2~20.04.3

Affected versions

1.*
1.22.2-2~20.04.1
1.22.2-2~20.04.2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "golang-1.22",
            "binary_version":  "1.22.2-2~20.04.3"
        },
        {
            "binary_name":  "golang-1.22-go",
            "binary_version":  "1.22.2-2~20.04.3"
        },
        {
            "binary_name":  "golang-1.22-src",
            "binary_version":  "1.22.2-2~20.04.3"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json"

Ubuntu:22.04:LTS / golang-1.22

Package

Name
golang-1.22
Purl
pkg:deb/ubuntu/golang-1.22?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.22.2-2~22.04.4

Affected versions

1.*
1.22.2-2~22.04
1.22.2-2~22.04.1
1.22.2-2~22.04.2
1.22.2-2~22.04.3

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "golang-1.22",
            "binary_version":  "1.22.2-2~22.04.4"
        },
        {
            "binary_name":  "golang-1.22-go",
            "binary_version":  "1.22.2-2~22.04.4"
        },
        {
            "binary_name":  "golang-1.22-src",
            "binary_version":  "1.22.2-2~22.04.4"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-33818",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56859",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56862",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56865",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56866",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78659",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78660",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78663",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78667",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78669",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-94439",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-94440",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json"

Ubuntu:24.04:LTS / golang-1.22

Package

Name
golang-1.22
Purl
pkg:deb/ubuntu/golang-1.22?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.22.2-2ubuntu0.5

Affected versions

1.*
1.22~rc1-2
1.22.0-1
1.22.0-2
1.22.1-1
1.22.1-1build1
1.22.2-2
1.22.2-2ubuntu0.1
1.22.2-2ubuntu0.2
1.22.2-2ubuntu0.3
1.22.2-2ubuntu0.4

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "golang-1.22",
            "binary_version":  "1.22.2-2ubuntu0.5"
        },
        {
            "binary_name":  "golang-1.22-go",
            "binary_version":  "1.22.2-2ubuntu0.5"
        },
        {
            "binary_name":  "golang-1.22-src",
            "binary_version":  "1.22.2-2ubuntu0.5"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [
        {
            "id":  "CVE-2026-33818",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56859",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56862",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56865",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-56866",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78659",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78660",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78663",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78667",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-78669",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-94439",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        },
        {
            "id":  "CVE-2026-94440",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json"