Bug#1144340: golang-1.27: CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865

Source: golang-1.27
Version: 1.27~rc2-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: clone -1 -2 -3
Control: reassign -2 src:golang-1.26 1.26.5-1
Control: retitle -2 golang-1.26: CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865
Control: reassign -3 src:golang-1.25 1.25.12-1
Control: retitle -3 golang-1.25: CVE-2026-33818 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865

Hi,

The following vulnerabilities were published for go.

CVE-2026-33818[0]:
| Enforce a recursion limit in Unmarshal to prevent stack exhaustion
| when parsing deeply-nested, recursive structures.


CVE-2026-56853[1]:
| When a server is configured to support unencrypted HTTP/2, it reads
| a few bytes from each new connection to see if they contain the
| HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being
| applied when doing this.


CVE-2026-56858[2]:
| Previously, pathological inputs could close an unescaped '/' early,
| allowing for attack-controlled data to inject arbitrary content,
| potentially leading to XSS.


CVE-2026-56859[3]:
| Previously, DecodeElement would reset the depth counter causing it
| to never fire; this could lead to stack exhaustion.


CVE-2026-56860[4]:
| Previously, resolving relative paths containing parent directory
| ('..') segments performed string conversions and buffer rewrites on
| each step, resulting in quadratic time complexity and high memory
| allocation overhead. Now, path resolution operates on a byte buffer
| using index-based backtracking for '..' segments, eliminating the
| quadratic time complexity and significantly reducing memory
| allocations.


CVE-2026-56862[5]:
| Handshake messages, such as KeyUpdate, are always considered as
| state-advancing, regardless of whether a handshake has been
| completed or not. As a result, a malicious client can keep sending
| KeyUpdate messages to force the server to keep performing key
| derivation operations indefinitely.


CVE-2026-56864[6]:
| A malicious GOSUMDB was capable of serving arbitrary module content
| not contained within the transparency log. This attack allows for a
| coordinating GOPROXY and GOSUMDB to serve a client malicious module
| content that cannot be detected by evaluating the transparency log.
| In order to determine if you have been affected:   rm -r go.sum
| go.work.sum vendor/ && go mod tidy


CVE-2026-56865[7]:
| A malicious GOPROXY was previously capable of forging up to two
| sumdb tiles that allow for a requested module to bypass the GOSUMDB
| check and persist attacker-controlled module content to a local Go
| module cache. This attack allows for a malicious GOPROXY to serve
| malicious module content that cannot be detected by evaluating the
| transparency log. All tiles are now correctly verified against their
| parents. In order to determine if you have been affected:   rm -r
| go.sum go.work.sum vendor/ && go mod tidy


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-33818
    https://www.cve.org/CVERecord?id=CVE-2026-33818
[1] https://security-tracker.debian.org/tracker/CVE-2026-56853
    https://www.cve.org/CVERecord?id=CVE-2026-56853
[2] https://security-tracker.debian.org/tracker/CVE-2026-56858
    https://www.cve.org/CVERecord?id=CVE-2026-56858
[3] https://security-tracker.debian.org/tracker/CVE-2026-56859
    https://www.cve.org/CVERecord?id=CVE-2026-56859
[4] https://security-tracker.debian.org/tracker/CVE-2026-56860
    https://www.cve.org/CVERecord?id=CVE-2026-56860
[5] https://security-tracker.debian.org/tracker/CVE-2026-56862
    https://www.cve.org/CVERecord?id=CVE-2026-56862
[6] https://security-tracker.debian.org/tracker/CVE-2026-56864
    https://www.cve.org/CVERecord?id=CVE-2026-56864
[7] https://security-tracker.debian.org/tracker/CVE-2026-56865
    https://www.cve.org/CVERecord?id=CVE-2026-56865

Regards,
Salvatore