Home / mailings [USN-8935-1] Go vulnerabilities
Posted on 19 October 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8935-1
October 19, 2026
golang-1.22 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Go.
Software Description:
- golang-1.22: Go programming language compiler
Details:
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovered that Go did not correctly verify checksum database tiles
against their parents. An attacker in control of a malicious module proxy
could possibly use this issue to bypass checksum database verification and
serve malicious module content. (CVE-2026-56865)
It was discovered that the Go HTTP client incorrectly returned connections
to the idle pool after a rejected HTTP/1 CONNECT request with a request
body. A remote attacker could possibly use this issue to perform HTTP
response poisoning attacks against reverse proxies. (CVE-2026-56866)
It was discovered that the Go HTTP/2 server did not apply header limits to
Trailer headers. A remote attacker could possibly use this issue to cause
Go to use excessive resources, leading to a denial of service.
(CVE-2026-78659)
It was discovered that the Go HTTP/2 implementation did not remove
malformed framing-related headers when forwarding responses. A remote
attacker could possibly use this issue to perform HTTP response smuggling
attacks when Go was acting as a reverse proxy. (CVE-2026-78660)
It was discovered that the Go HTTP/2 server could refund connection-level
flow control twice for the same data under certain circumstances. A remote
attacker could possibly use this issue to bypass the configured
connection-level flow control limit. (CVE-2026-78663)
It was discovered that Go did not limit the size of Range headers parsed
when serving content over HTTP. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-78667)
It was discovered that the Go HTTP/2 implementation incorrectly handled
SETTINGS frames that changed the initial window size. A remote attacker
could possibly use this issue to cause Go to use excessive resources,
leading to a denial of service. (CVE-2026-78669)
It was discovered that the Go HTTP server continued to serve requests on a
connection after sending a successful response to an HTTP/1 CONNECT
request. A remote attacker could possibly use this issue to perform HTTP
request smuggling attacks. (CVE-2026-94439)
It was discovered that Go did not enforce memory limits on the first line
of a part when parsing multipart forms. A remote attacker could possibly
use this issue to cause Go to use excessive resources, leading to a denial
of service. (CVE-2026-94440)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
golang-1.22 1.22.2-2ubuntu0.5
golang-1.22-go 1.22.2-2ubuntu0.5
golang-1.22-src 1.22.2-2ubuntu0.5
Ubuntu 22.04 LTS
golang-1.22 1.22.2-2~22.04.4
golang-1.22-go 1.22.2-2~22.04.4
golang-1.22-src 1.22.2-2~22.04.4
Ubuntu 20.04 LTS
golang-1.22 1.22.2-2~20.04.3
golang-1.22-go 1.22.2-2~20.04.3
golang-1.22-src 1.22.2-2~20.04.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8935-1
CVE-2026-33818, CVE-2026-56859, CVE-2026-56862, CVE-2026-56865,
CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663,
CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440
Package Information:
https://launchpad.net/ubuntu/+source/golang-1.22/1.22.2-2ubuntu0.5
https://launchpad.net/ubuntu/+source/golang-1.22/1.22.2-2~22.04.4
https://launchpad.net/ubuntu/+source/golang-1.22/1.22.2-2~20.04.3
--===============5675413137798006840==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
