{"id":"USN-8935-1","summary":"golang-1.22 vulnerabilities","details":"It was discovered that Go did not enforce a maximum recursion depth when\nparsing deeply nested ASN.1 structures. An attacker could possibly use this\nissue to cause Go to crash, resulting in a denial of service.\n(CVE-2026-33818)\n\nIt was discovered that Go incorrectly reset the depth counter when decoding\nXML elements. An attacker could possibly use this issue to cause Go to\ncrash via deeply nested XML input, resulting in a denial of service.\n(CVE-2026-56859)\n\nIt was discovered that Go incorrectly handled TLS KeyUpdate messages after\nthe handshake was completed. A remote attacker could possibly use this\nissue to cause Go to use excessive resources, leading to a denial of\nservice. (CVE-2026-56862)\n\nIt was discovered that Go did not correctly verify checksum database tiles\nagainst their parents. An attacker in control of a malicious module proxy\ncould possibly use this issue to bypass checksum database verification and\nserve malicious module content. (CVE-2026-56865)\n\nIt was discovered that the Go HTTP client incorrectly returned connections\nto the idle pool after a rejected HTTP/1 CONNECT request with a request\nbody. A remote attacker could possibly use this issue to perform HTTP\nresponse poisoning attacks against reverse proxies. (CVE-2026-56866)\n\nIt was discovered that the Go HTTP/2 server did not apply header limits to\nTrailer headers. A remote attacker could possibly use this issue to cause\nGo to use excessive resources, leading to a denial of service.\n(CVE-2026-78659)\n\nIt was discovered that the Go HTTP/2 implementation did not remove\nmalformed framing-related headers when forwarding responses. A remote\nattacker could possibly use this issue to perform HTTP response smuggling\nattacks when Go was acting as a reverse proxy. (CVE-2026-78660)\n\nIt was discovered that the Go HTTP/2 server could refund connection-level\nflow control twice for the same data under certain circumstances. A remote\nattacker could possibly use this issue to bypass the configured\nconnection-level flow control limit. (CVE-2026-78663)\n\nIt was discovered that Go did not limit the size of Range headers parsed\nwhen serving content over HTTP. A remote attacker could possibly use this\nissue to cause Go to use excessive resources, leading to a denial of\nservice. (CVE-2026-78667)\n\nIt was discovered that the Go HTTP/2 implementation incorrectly handled\nSETTINGS frames that changed the initial window size. A remote attacker\ncould possibly use this issue to cause Go to use excessive resources,\nleading to a denial of service. (CVE-2026-78669)\n\nIt was discovered that the Go HTTP server continued to serve requests on a\nconnection after sending a successful response to an HTTP/1 CONNECT\nrequest. A remote attacker could possibly use this issue to perform HTTP\nrequest smuggling attacks. (CVE-2026-94439)\n\nIt was discovered that Go did not enforce memory limits on the first line\nof a part when parsing multipart forms. A remote attacker could possibly\nuse this issue to cause Go to use excessive resources, leading to a denial\nof service. (CVE-2026-94440)","modified":"2026-10-19T23:43:23.579990891Z","published":"2026-10-19T11:40:22Z","related":["UBUNTU-CVE-2026-33818","UBUNTU-CVE-2026-56859","UBUNTU-CVE-2026-56862","UBUNTU-CVE-2026-56865","UBUNTU-CVE-2026-56866","UBUNTU-CVE-2026-78659","UBUNTU-CVE-2026-78660","UBUNTU-CVE-2026-78663","UBUNTU-CVE-2026-78667","UBUNTU-CVE-2026-78669","UBUNTU-CVE-2026-94439","UBUNTU-CVE-2026-94440"],"upstream":["CVE-2026-33818","CVE-2026-56859","CVE-2026-56862","CVE-2026-56865","CVE-2026-56866","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78667","CVE-2026-78669","CVE-2026-94439","CVE-2026-94440","UBUNTU-CVE-2026-33818","UBUNTU-CVE-2026-56859","UBUNTU-CVE-2026-56862","UBUNTU-CVE-2026-56865","UBUNTU-CVE-2026-56866","UBUNTU-CVE-2026-78659","UBUNTU-CVE-2026-78660","UBUNTU-CVE-2026-78663","UBUNTU-CVE-2026-78667","UBUNTU-CVE-2026-78669","UBUNTU-CVE-2026-94439","UBUNTU-CVE-2026-94440"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8935-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-33818"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56859"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56862"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56865"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-56866"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-78659"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-78660"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-78663"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-78667"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-78669"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-94439"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-94440"}],"affected":[{"package":{"name":"golang-1.22","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/golang-1.22?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~20.04.3"}]}],"versions":["1.22.2-2~20.04.1","1.22.2-2~20.04.2"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-1.22","binary_version":"1.22.2-2~20.04.3"},{"binary_version":"1.22.2-2~20.04.3","binary_name":"golang-1.22-go"},{"binary_version":"1.22.2-2~20.04.3","binary_name":"golang-1.22-src"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json"}},{"package":{"name":"golang-1.22","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/golang-1.22?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2~22.04.4"}]}],"versions":["1.22.2-2~22.04","1.22.2-2~22.04.1","1.22.2-2~22.04.2","1.22.2-2~22.04.3"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-1.22","binary_version":"1.22.2-2~22.04.4"},{"binary_name":"golang-1.22-go","binary_version":"1.22.2-2~22.04.4"},{"binary_name":"golang-1.22-src","binary_version":"1.22.2-2~22.04.4"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2026-33818","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56859","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56862","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-56865"},{"id":"CVE-2026-56866","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-78659"},{"id":"CVE-2026-78660","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-78663","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-78667","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-78669"},{"id":"CVE-2026-94439","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-94440","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}],"ecosystem":"Ubuntu:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json"}},{"package":{"name":"golang-1.22","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/golang-1.22?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-2ubuntu0.5"}]}],"versions":["1.22~rc1-2","1.22.0-1","1.22.0-2","1.22.1-1","1.22.1-1build1","1.22.2-2","1.22.2-2ubuntu0.1","1.22.2-2ubuntu0.2","1.22.2-2ubuntu0.3","1.22.2-2ubuntu0.4"],"ecosystem_specific":{"binaries":[{"binary_name":"golang-1.22","binary_version":"1.22.2-2ubuntu0.5"},{"binary_name":"golang-1.22-go","binary_version":"1.22.2-2ubuntu0.5"},{"binary_version":"1.22.2-2ubuntu0.5","binary_name":"golang-1.22-src"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8935-1.json","cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-33818"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56859"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-56862"},{"id":"CVE-2026-56865","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-56866","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-78659"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-78660"},{"id":"CVE-2026-78663","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-78667"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-78669"},{"id":"CVE-2026-94439","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-94440","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:24.04:LTS"}}}],"schema_version":"1.9.0"}