Re: [Buildroot] [PATCH 1/2] package/go: security bump to version 1.26.3

[Julien Olivain via buildroot <buildroot@buildroot.org>]

On 07/05/2026 21:50, Peter Korsgaard wrote:
> Fixes the following security issues:
> 
> CVE-2026-33811: net: crash when handling long CNAME response
> CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given 
> bad
>                 SETTINGS_MAX_FRAME_SIZE
> CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
> CVE-2026-39819: md/go: "go bug" follows symlinks in predictable 
> temporary
>                 filenames
> CVE-2026-39820: net/mail: quadratic string concatenation in 
> consumeComment
> CVE-2026-39823: html/template: bypass of meta content URL escaping 
> causes
>                 XSS
> CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with 
> more
>                 than urlmaxqueryparams parameters
> CVE-2026-39826: html/template: escaper bypass leads to XSS
> CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL 
> byte on
>                 Windows
> CVE-2026-42499: net/mail: quadratic string concatenation in 
> consumePhrase
> CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum 
> database
> 
> go1.26.3 (released 2026-05-07) includes security fixes to the go 
> command,
> the pack tool, and the html/template, net, net/http, net/http/httputil,
> net/mail, and syscall packages, as well as bug fixes to the go command, 
> the
> go fix command, the compiler, the linker, the runtime, and the
> crypto/fips140, crypto/tls, go/types, and os packages.
> 
> https://go.dev/doc/devel/release#go1.26.3
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot