{"id":"MGASA-2026-0341","summary":"Updated golang packages fix security vulnerabilities","details":"CVE-2026-56865  A malicious GOPROXY was previously capable of forging up\nto two sumdb tiles that allow for a requested module to bypass the\nGOSUMDB check and persist attacker-controlled module content to a local\nGo module cache.\nCVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary\nmodule content not contained within the transparency log.\nCVE-2026-56859 Previously, DecodeElement would reset the depth counter\ncausing it to never fire; this could lead to stack exhaustion.\nCVE-2026-56853 When a server is configured to support unencrypted\nHTTP/2, it reads a few bytes from each new connection to see if they\ncontain the HTTP/2 client preface. Previously, this was being done with\nno timeout applied. ReadHeaderTimeout is now applied for this.\nCVE-2026-56860 Previously, resolving relative paths containing parent\ndirectory (|..|) segments performed string conversions and buffer\nrewrites on each step, resulting in quadratic time complexity and high\nmemory allocation overhead.\nCVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the\nsize of a parameter value overflows the message buffer.\nCVE-2026-56862 Previously, we always counted handshake messages, such as\nKeyUpdate, as state-advancing, regardless of whether a handshake has\nbeen completed or not. As a result, a malicious client can keep sending\nKeyUpdate messages to force the server to keep performing key derivation\noperations indefinitely.\nCVE-2026-56858 Previously, pathological inputs could close an unescaped\n|/| early, allowing for attack-controlled data to inject arbitrary\ncontent, potentially leading to XSS.\nCVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted\nPunycode-encoded labels that decode to an ASCII-only label. For example,\nToUnicode(\"xn--example-.com\") incorrectly returned the name\n\"example.com\" rather than an error.\nCVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack\nexhaustion when parsing deeply-nested, recursive structures.\n","modified":"2026-08-30T04:41:21.002923652Z","published":"2026-08-30T04:17:09Z","upstream":["CVE-2026-33818","CVE-2026-39821","CVE-2026-46600","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-56864","CVE-2026-56865"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0341.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36142"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/08/13/13"}],"affected":[{"package":{"name":"golang","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/golang?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0341.json"}},{"package":{"name":"golang","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/golang?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.13-1.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0341.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}