---
title: "Go October 2026 Security Releases: 16 Stdlib Fixes"
url: https://erroneo.us/security/briefs/go-october-2026-security-releases/
description: "Go 1.27.2/1.26.9 fix 15 bugs (HTTP/2 crash and memory DoS, smuggling, html/template); 1.27.3/1.26.10 distrust bad CA intermediates. Rebuild this week."
type: security-brief
section: "Security Digest"
date_published: 2026-10-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-97032", "CVE-2026-78659", "CVE-2026-78669", "CVE-2026-78663", "CVE-2026-78660", "CVE-2026-56866", "CVE-2026-94439", "CVE-2026-78667", "CVE-2026-94440", "CVE-2026-97031", "CVE-2026-94448", "CVE-2026-97030", "CVE-2026-94444", "CVE-2026-94447", "CVE-2026-56857", "CVE-2026-111943"]
severity: "high"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Go October 2026 Security Releases: 16 Stdlib Fixes

**Verdict: Patch this week.** Rebuild and redeploy Go services with Go 1.27.3 or 1.26.10 this week, starting with internet-facing HTTP/2 servers and reverse proxies; none of these bugs is known to be exploited.

- **Who must act:** Teams shipping Go binaries that serve HTTP/2 or HTTP/1 to untrusted clients, Go reverse proxies, apps rendering JavaScript through html/template, and anyone verifying TLS chains with crypto/x509 on systems with stale trust stores.
- **Who can relax:** Go code that never serves network traffic or renders templates can take the update on its next release; Windows-only Root.Mkdir and toolchain checksum issues need a malicious project or proxy you chose to use.
- **Affected:** Go before 1.26.9; Go 1.27.0 and 1.27.1; golang.org/x/net before v0.60.0 (HTTP/2 issues); Go before 1.26.10 and Go 1.27.x before 1.27.3 (crypto/x509 intermediate distrust)
- **Fixed:** Go 1.27.3; Go 1.26.10; Go 1.27.2 and 1.26.9 (all but CVE-2026-111943); golang.org/x/net v0.60.0
- **CVEs:** CVE-2026-97032, CVE-2026-78659, CVE-2026-78669, CVE-2026-78663, CVE-2026-78660, CVE-2026-56866, CVE-2026-94439, CVE-2026-78667, CVE-2026-94440, CVE-2026-97031, CVE-2026-94448, CVE-2026-97030, CVE-2026-94444, CVE-2026-94447, CVE-2026-56857, CVE-2026-111943
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Check the toolchain and the binaries you ship: go version, and go version -m ./yourbinary for deployed builds.
2. Move builds to Go 1.27.3 or 1.26.10 (for example go get toolchain@go1.27.3, or update the golang base image in your Dockerfile), then rebuild and redeploy every service.
3. If you use golang.org/x/net/http2 directly, run go get golang.org/x/net@v0.60.0 && go mod tidy.
4. Run govulncheck ./... to see which of the 16 issues your code actually reaches.
5. Prioritize internet-facing HTTP/2 servers, httputil.ReverseProxy deployments and services that render user-influenced JavaScript through html/template.

### How to check if you are affected

- Run go version -m against deployed binaries or container images; anything built with go1.26.8 or earlier, or go1.27.0-1.27.2, lacks some fixes.
- Run govulncheck ./... or govulncheck -mode=binary ./yourbinary and look for GO-2026-6599 through GO-2026-6617 and GO-2026-6809.
- Watch HTTP/2 services for unexplained crashes with concurrent map or HPACK stack traces, memory spikes from large Trailer declarations, or CPU spikes from SETTINGS floods.

## What happened

Go shipped two security releases in October 2026. On October 8, [Go 1.27.2 and 1.26.9](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) fixed 15 vulnerabilities in the standard library and the `go` command. Most are in `net/http`. On October 19, [Go 1.27.3 and 1.26.10](https://groups.google.com/g/golang-announce/c/66pojueaQek) followed as an urgent-track fix to `crypto/x509` (CVE-2026-111943). That release blocks "a small set of intermediate certificates due to specific security concerns around their operation." The Go team "highly recommend[s] immediately upgrading." It did not name the certificate authority as of October 21, 2026.

The October 8 fixes fall into four groups:

- **HTTP/2 denial of service:** a client can crash a server by racing the HPACK encoder against `SETTINGS_HEADER_TABLE_SIZE` changes ([CVE-2026-97032](https://pkg.go.dev/vuln/GO-2026-6617)). Other bugs let a client exhaust memory with a "Trailer" header declaring many fields, bypassing `MaxHeaderBytes` (CVE-2026-78659), burn CPU with repeated `SETTINGS_INITIAL_WINDOW_SIZE` frames (CVE-2026-78669), or get flow control refunded twice (CVE-2026-78663). RyotaK of GMO Flatt Security is credited with the first two.
- **Smuggling and desync:** the HTTP/2 transport forwarded malformed framing headers that can enable response smuggling through a reverse proxy (CVE-2026-78660). HTTP/1 CONNECT handling could desynchronize pooled client connections (CVE-2026-56866) or keep serving HTTP on a tunneled server connection (CVE-2026-94439).
- **Other resource limits and escaping:** Range-header CPU exhaustion in `FileServer`/`ServeContent` (CVE-2026-78667), a multipart memory-limit bypass (CVE-2026-94440), ECH memory amplification in `crypto/tls` (CVE-2026-97031), and two `html/template` JavaScript escaping errors (CVE-2026-94448, CVE-2026-97030).
- **Toolchain and OS:** two `cmd/go` checksum bypasses that require a malicious project plus a malicious module proxy (CVE-2026-94444, CVE-2026-94447), and a Windows `os.Root` junction escape (CVE-2026-56857).

## Who is affected

Any program built with Go before 1.26.9, or with 1.27.0 or 1.27.1, carries the October 8 bugs. Programs built before 1.26.10, or with any 1.27 release before 1.27.3, lack the certificate denylist. The [release history](https://go.dev/doc/devel/release) lists the affected packages. Go statically links the standard library into every binary, so upgrading the toolchain on your laptop changes nothing in production until you rebuild and redeploy. The HTTP/2 fixes also landed in `golang.org/x/net` v0.60.0 for code that imports `x/net/http2` directly, according to the Go vulnerability database.

## Do you really need to act?

For internet-facing Go HTTP servers, yes, this week. The HPACK race and the Trailer memory bug need no authentication. Default `net/http` servers negotiate HTTP/2 over TLS automatically, so an exposed service is reachable unless you disabled HTTP/2. CISA's ADP enrichment on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-97032) scores CVE-2026-97032 at CVSS 3.1 7.5 (availability only). None of these CVEs is in CISA KEV, and no exploitation had been reported as of October 21, 2026.

The smuggling bugs matter most if you run Go reverse proxies in front of HTTP/1 backends. The `html/template` fixes matter if templates render untrusted data inside JavaScript template literals. On the x509 change, the Go team says most platforms use system roots. The denylist covers "narrower cases" where system trust stores may not be updated, per [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809) and [Go issue 82345](https://go.dev/issue/82345). The toolchain and Windows `os.Root` bugs are low-priority for most teams.

## What to do now

1. See what you build and ship: `go version` for the toolchain and `go version -m ./yourbinary` for deployed artifacts.
2. Pin the fixed toolchain, for example with `go get toolchain@go1.27.3` in each module, or bump the `golang` base image tag in Dockerfiles and CI.
3. Update `golang.org/x/net` if you import it: `go get golang.org/x/net@v0.60.0 && go mod tidy`.
4. Rebuild and redeploy every service and container, starting with public HTTP/2 endpoints and reverse proxies.
5. Run `govulncheck ./...` to confirm which issues your code reaches, and use the result for prioritization, not as a reason to skip the rebuild.

## How to tell if you were hit

Most of these bugs cause outages, not intrusions. Look for HTTP/2 server crashes with stack traces in the HPACK encoder or concurrent map writes, sudden memory growth on requests with large `Trailer` headers, and CPU spikes tied to clients sending floods of SETTINGS frames or Range headers with hundreds of ranges. For smuggling, compare proxy and backend access logs for responses that do not match their requests. To find unpatched builds, run `govulncheck -mode=binary` across your release artifacts.

## Timeline

- Oct 8, 2026 — Go 1.27.2 and 1.26.9 are released with 15 security fixes, and the CVE records are published.
- Oct 19, 2026 — Go 1.27.3 and 1.26.10 are released with the crypto/x509 intermediate-certificate denylist (CVE-2026-111943).
- Oct 21, 2026 — GO-2026-6809 is published in the Go vulnerability database.

## Sources

1. [Go — Release History (go1.27.2, go1.26.9, go1.27.3, go1.26.10)](https://go.dev/doc/devel/release)
2. [golang-announce — [security] Go 1.27.2 and Go 1.26.9 are released (Oct 8, 2026)](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
3. [golang-announce — [security] Go 1.27.3 and Go 1.26.10 are released (Oct 19, 2026)](https://groups.google.com/g/golang-announce/c/66pojueaQek)
4. [Go vulnerability database — GO-2026-6617 (CVE-2026-97032)](https://pkg.go.dev/vuln/GO-2026-6617)
5. [Go vulnerability database — GO-2026-6809 (CVE-2026-111943)](https://pkg.go.dev/vuln/GO-2026-6809)
6. [CVE record — CVE-2026-97032](https://www.cve.org/CVERecord?id=CVE-2026-97032)
7. [Go issue 82345 — crypto/x509: mitigation for security concerns with a specific Certificate Authority](https://go.dev/issue/82345)

---
Source page: https://erroneo.us/security/briefs/go-october-2026-security-releases/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt