erroneo.us
Search all guides⌘K

Security Digest · Oct 8, 2026 · Vulnerability · Language runtime

Go October 2026 Security Releases: 16 Stdlib Fixes

Go 1.27.2/1.26.9 fix 15 bugs (HTTP/2 crash and memory DoS, smuggling, html/template); 1.27.3/1.26.10 distrust bad CA intermediates. Rebuild this week.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Patch this week

Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.

Who must act: Teams shipping Go binaries that serve HTTP/2 or HTTP/1 to untrusted clients, Go reverse proxies, apps rendering JavaScript through html/template, and anyone verifying TLS chains with crypto/x509 on systems with stale trust stores.

Who can relax: Go code that never serves network traffic or renders templates can take the update on its next release; Windows-only Root.Mkdir and toolchain checksum issues need a malicious project or proxy you chose to use.

Affected
Go before 1.26.9
Go 1.27.0 and 1.27.1
golang.org/x/net before v0.60.0 (HTTP/2 issues)
Go before 1.26.10 and Go 1.27.x before 1.27.3 (crypto/x509 intermediate distrust)
Fixed in
Go 1.27.3
Go 1.26.10
Go 1.27.2 and 1.26.9 (all but CVE-2026-111943)
golang.org/x/net v0.60.0
CVSS
7.5 (v3.1, CISA-ADP)
EPSS
0.6% (percentile 47)
CISA KEV
Not listed
Exploitation
No known exploitation
Severity
High

What to do

  1. Check the toolchain and the binaries you ship: go version, and go version -m ./yourbinary for deployed builds.
  2. Move builds to Go 1.27.3 or 1.26.10 (for example go get toolchain@go1.27.3, or update the golang base image in your Dockerfile), then rebuild and redeploy every service.
  3. If you use golang.org/x/net/http2 directly, run go get golang.org/x/net@v0.60.0 && go mod tidy.
  4. Run govulncheck ./... to see which of the 16 issues your code actually reaches.
  5. Prioritize internet-facing HTTP/2 servers, httputil.ReverseProxy deployments and services that render user-influenced JavaScript through html/template.

How to check if you are affected or compromised

  • Run go version -m against deployed binaries or container images; anything built with go1.26.8 or earlier, or go1.27.0-1.27.2, lacks some fixes.
  • Run govulncheck ./... or govulncheck -mode=binary ./yourbinary and look for GO-2026-6599 through GO-2026-6617 and GO-2026-6809.
  • Watch HTTP/2 services for unexplained crashes with concurrent map or HPACK stack traces, memory spikes from large Trailer declarations, or CPU spikes from SETTINGS floods.

What happened#

Go shipped two security releases in October 2026. On October 8, Go 1.27.2 and 1.26.9 fixed 15 vulnerabilities in the standard library and the go command. Most are in net/http. On October 19, Go 1.27.3 and 1.26.10 followed as an urgent-track fix to crypto/x509 (CVE-2026-111943). That release blocks "a small set of intermediate certificates due to specific security concerns around their operation." The Go team "highly recommend[s] immediately upgrading." It did not name the certificate authority as of October 21, 2026.

The October 8 fixes fall into four groups:

  • HTTP/2 denial of service: a client can crash a server by racing the HPACK encoder against SETTINGS_HEADER_TABLE_SIZE changes (CVE-2026-97032). Other bugs let a client exhaust memory with a "Trailer" header declaring many fields, bypassing MaxHeaderBytes (CVE-2026-78659), burn CPU with repeated SETTINGS_INITIAL_WINDOW_SIZE frames (CVE-2026-78669), or get flow control refunded twice (CVE-2026-78663). RyotaK of GMO Flatt Security is credited with the first two.
  • Smuggling and desync: the HTTP/2 transport forwarded malformed framing headers that can enable response smuggling through a reverse proxy (CVE-2026-78660). HTTP/1 CONNECT handling could desynchronize pooled client connections (CVE-2026-56866) or keep serving HTTP on a tunneled server connection (CVE-2026-94439).
  • Other resource limits and escaping: Range-header CPU exhaustion in FileServer/ServeContent (CVE-2026-78667), a multipart memory-limit bypass (CVE-2026-94440), ECH memory amplification in crypto/tls (CVE-2026-97031), and two html/template JavaScript escaping errors (CVE-2026-94448, CVE-2026-97030).
  • Toolchain and OS: two cmd/go checksum bypasses that require a malicious project plus a malicious module proxy (CVE-2026-94444, CVE-2026-94447), and a Windows os.Root junction escape (CVE-2026-56857).

Who is affected#

Any program built with Go before 1.26.9, or with 1.27.0 or 1.27.1, carries the October 8 bugs. Programs built before 1.26.10, or with any 1.27 release before 1.27.3, lack the certificate denylist. The release history lists the affected packages. Go statically links the standard library into every binary, so upgrading the toolchain on your laptop changes nothing in production until you rebuild and redeploy. The HTTP/2 fixes also landed in golang.org/x/net v0.60.0 for code that imports x/net/http2 directly, according to the Go vulnerability database.

Do you really need to act?#

For internet-facing Go HTTP servers, yes, this week. The HPACK race and the Trailer memory bug need no authentication. Default net/http servers negotiate HTTP/2 over TLS automatically, so an exposed service is reachable unless you disabled HTTP/2. CISA's ADP enrichment on the CVE record scores CVE-2026-97032 at CVSS 3.1 7.5 (availability only). None of these CVEs is in CISA KEV, and no exploitation had been reported as of October 21, 2026.

The smuggling bugs matter most if you run Go reverse proxies in front of HTTP/1 backends. The html/template fixes matter if templates render untrusted data inside JavaScript template literals. On the x509 change, the Go team says most platforms use system roots. The denylist covers "narrower cases" where system trust stores may not be updated, per GO-2026-6809 and Go issue 82345. The toolchain and Windows os.Root bugs are low-priority for most teams.

What to do now#

  1. See what you build and ship: go version for the toolchain and go version -m ./yourbinary for deployed artifacts.
  2. Pin the fixed toolchain, for example with go get toolchain@go1.27.3 in each module, or bump the golang base image tag in Dockerfiles and CI.
  3. Update golang.org/x/net if you import it: go get golang.org/x/net@v0.60.0 && go mod tidy.
  4. Rebuild and redeploy every service and container, starting with public HTTP/2 endpoints and reverse proxies.
  5. Run govulncheck ./... to confirm which issues your code reaches, and use the result for prioritization, not as a reason to skip the rebuild.

How to tell if you were hit#

Most of these bugs cause outages, not intrusions. Look for HTTP/2 server crashes with stack traces in the HPACK encoder or concurrent map writes, sudden memory growth on requests with large Trailer headers, and CPU spikes tied to clients sending floods of SETTINGS frames or Range headers with hundreds of ranges. For smuggling, compare proxy and backend access logs for responses that do not match their requests. To find unpatched builds, run govulncheck -mode=binary across your release artifacts.

Timeline#

  • — Go 1.27.2 and 1.26.9 are released with 15 security fixes, and the CVE records are published.
  • — Go 1.27.3 and 1.26.10 are released with the crypto/x509 intermediate-certificate denylist (CVE-2026-111943).
  • — GO-2026-6809 is published in the Go vulnerability database.

Vulnerability records

  • CVE-2026-97032 · HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.
  • CVE-2026-78659 · When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler.
  • CVE-2026-78669 · A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS…
  • CVE-2026-78663 · The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread…
  • CVE-2026-78660 · Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.
  • CVE-2026-56866 · When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the…
  • CVE-2026-94439 · When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to…
  • CVE-2026-78667 · When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
  • CVE-2026-94440 · Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than…
  • CVE-2026-97031 · Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory…
  • CVE-2026-94448 · When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.
  • CVE-2026-97030 · A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.
  • CVE-2026-94444 · Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to…
  • CVE-2026-94447 · Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the…
  • CVE-2026-56857 · On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction…
  • CVE-2026-111943 · On most platforms, Go uses the given system root certificates.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Go — Release History (go1.27.2, go1.26.9, go1.27.3, go1.26.10) go.dev
  2. golang-announce — [security] Go 1.27.2 and Go 1.26.9 are released (Oct 8, 2026) groups.google.com
  3. golang-announce — [security] Go 1.27.3 and Go 1.26.10 are released (Oct 19, 2026) groups.google.com
  4. Go vulnerability database — GO-2026-6617 (CVE-2026-97032) pkg.go.dev
  5. Go vulnerability database — GO-2026-6809 (CVE-2026-111943) pkg.go.dev
  6. CVE record — CVE-2026-97032 cve.org
  7. Go issue 82345 — crypto/x509: mitigation for security concerns with a specific Certificate Authority go.dev