* [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 @ 2026-08-31 6:14 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-08-31 6:14 ` [OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-09-17 13:58 ` [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Paul Barker 0 siblings, 2 replies; 5+ messages in thread From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-31 6:14 UTC (permalink / raw) To: openembedded-core; +Cc: xe-linux-external, Hetvi Thakar From: Hetvi Thakar <hthakar@cisco.com> This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f [2] https://pkg.go.dev/vuln/GO-2026-4918 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-33814.patch | 44 +++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index 99c5f8b63b..ee2f5ca277 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -62,6 +62,7 @@ SRC_URI += "\ file://CVE-2026-25679.patch \ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ + file://CVE-2026-33814.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch new file mode 100644 index 0000000000..8265bf205f --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch @@ -0,0 +1,44 @@ +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001 +From: Mark Freeman <mark@golang.org> +Date: Fri, 17 Apr 2026 16:28:03 -0400 +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8 + +Fixes #78477 + +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323 +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> +TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com> + +CVE: CVE-2026-33814 +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f] + +Backport Changes: +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because + their x/net version updates are not required for this focused backport. +- Omitted removal of the SETTINGS_ENABLE_CONNECT_PROTOCOL-specific + s.Valid call because Go 1.22 does not contain that setting case; validation + is added at the start of the settings callback instead. + +(cherry picked from commit 9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f) +Signed-off-by: Hetvi Thakar <hthakar@cisco.com> +--- + src/net/http/h2_bundle.go | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go +index c1a2e76ea4d..2f5a6d3d5a2 100644 +--- a/src/net/http/h2_bundle.go ++++ b/src/net/http/h2_bundle.go +@@ -9910,6 +9910,9 @@ func (rl *http2clientConnReadLoop) processSettingsNoWrite(f *http2SettingsFrame) + + var seenMaxConcurrentStreams bool + err := f.ForeachSetting(func(s http2Setting) error { ++ if err := s.Valid(); err != nil { ++ return err ++ } + switch s.ID { + case http2SettingMaxFrameSize: + cc.maxFrameSize = s.Val +-- +2.35.6 -- 2.35.6 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823 2026-08-31 6:14 [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-31 6:14 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-09-17 13:58 ` [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Paul Barker 1 sibling, 0 replies; 5+ messages in thread From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-31 6:14 UTC (permalink / raw) To: openembedded-core; +Cc: xe-linux-external, Hetvi Thakar From: Hetvi Thakar <hthakar@cisco.com> This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811 [2] https://pkg.go.dev/vuln/GO-2026-4982 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-39823.patch | 100 ++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index ee2f5ca277..a2c0efa378 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -63,6 +63,7 @@ SRC_URI += "\ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ file://CVE-2026-33814.patch \ + file://CVE-2026-39823.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-39823.patch b/meta/recipes-devtools/go/go/CVE-2026-39823.patch new file mode 100644 index 0000000000..00e25bb35c --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-39823.patch @@ -0,0 +1,100 @@ +From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001 +From: Neal Patel <nealpatel@google.com> +Date: Wed, 22 Apr 2026 18:41:25 -0400 +Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs + in meta content attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The WHATWG "shared declarative refresh steps" algorithm (§4.2.5.3) +skips ASCII whitespace between "url" and "=" when parsing the URL +portion of a meta content attribute. + +Thank you to Samy Ghannad for reporting this issue. + +Updates #78913 +Fixes #79031 +Fixes CVE-2026-39823 + +Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774 +Reviewed-on: https://go-review.googlesource.com/c/go/+/769920 +Reviewed-by: Roland Shoemaker <roland@golang.org> +TryBot-Bypass: Roland Shoemaker <roland@golang.org> +(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9) +Reviewed-on: https://go-review.googlesource.com/c/go/+/772101 +LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> + +CVE: CVE-2026-39823 +Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811] + +(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811) +Signed-off-by: Hetvi Thakar <hthakar@cisco.com> +--- + src/html/template/escape_test.go | 20 ++++++++++++++++++++ + src/html/template/transition.go | 12 +++++++----- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go +index ce064407384..c9e566a9076 100644 +--- a/src/html/template/escape_test.go ++++ b/src/html/template/escape_test.go +@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) { + `<meta http-equiv="refresh" content="{{"asd: 123"}}">`, + `<meta http-equiv="refresh" content="asd: 123">`, + }, ++ { ++ "meta content url with whitespace before equals", ++ `<meta http-equiv="refresh" content="0;url ={{"javascript:alert(1)"}}">`, ++ `<meta http-equiv="refresh" content="0;url =#ZgotmplZ">`, ++ }, ++ { ++ "meta content url with tab before equals", ++ "<meta http-equiv=\"refresh\" content=\"0;url\t={{\"javascript:alert(1)\"}}\">", ++ "<meta http-equiv=\"refresh\" content=\"0;url\t=#ZgotmplZ\">", ++ }, ++ { ++ "meta content url with space after equals", ++ `<meta http-equiv="refresh" content="0;url= {{"javascript:alert(1)"}}">`, ++ `<meta http-equiv="refresh" content="0;url= #ZgotmplZ">`, ++ }, ++ { ++ "meta content url with whitespace both sides of equals", ++ "<meta http-equiv=\"refresh\" content=\"0;url \t= {{\"javascript:alert(1)\"}}\">", ++ "<meta http-equiv=\"refresh\" content=\"0;url \t= #ZgotmplZ\">", ++ }, + } + + for _, test := range tests { +diff --git a/src/html/template/transition.go b/src/html/template/transition.go +index 5aa3c35440b..ac05d56b418 100644 +--- a/src/html/template/transition.go ++++ b/src/html/template/transition.go +@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) { + + // tMetaContent is the context transition function for the meta content attribute state. + func tMetaContent(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { +- if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) { +- c.state = stateMetaContentURL +- return c, i + 4 ++ for i := range len(s) { ++ if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) { ++ if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' { ++ c.state = stateMetaContentURL ++ return c, j + 1 ++ } + } + } + return c, len(s) +@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) { + + // tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state. + func tMetaContentURL(c context, s []byte) (context, int) { +- for i := 0; i < len(s); i++ { ++ for i := range len(s) { + if s[i] == ';' { + c.state = stateMetaContent + return c, i + 1 +-- +2.35.6 -- 2.35.6 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 2026-08-31 6:14 [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-08-31 6:14 ` [OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-09-17 13:58 ` Paul Barker 2026-10-19 9:52 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 1 sibling, 1 reply; 5+ messages in thread From: Paul Barker @ 2026-09-17 13:58 UTC (permalink / raw) To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco), openembedded-core Cc: xe-linux-external, Yoann Congal On Sun, 2026-08-30 at 23:14 -0700, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > From: Hetvi Thakar <hthakar@cisco.com> > > This patch applies the upstream fix as referenced in [2], > using the commit shown in [1]. > > [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f > [2] https://pkg.go.dev/vuln/GO-2026-4918 > > Signed-off-by: Hetvi Thakar <hthakar@cisco.com> > --- > meta/recipes-devtools/go/go-1.22.12.inc | 1 + > .../go/go/CVE-2026-33814.patch | 44 +++++++++++++++++++ > 2 files changed, 45 insertions(+) > create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch > > diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc > index 99c5f8b63b..ee2f5ca277 100644 > --- a/meta/recipes-devtools/go/go-1.22.12.inc > +++ b/meta/recipes-devtools/go/go-1.22.12.inc > @@ -62,6 +62,7 @@ SRC_URI += "\ > file://CVE-2026-25679.patch \ > file://CVE-2026-32288.patch \ > file://CVE-2026-27145.patch \ > + file://CVE-2026-33814.patch \ > " > SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" > > diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch > new file mode 100644 > index 0000000000..8265bf205f > --- /dev/null > +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch > @@ -0,0 +1,44 @@ > +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001 > +From: Mark Freeman <mark@golang.org> > +Date: Fri, 17 Apr 2026 16:28:03 -0400 > +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8 > + > +Fixes #78477 > + > +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f > +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323 > +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> > +TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com> > + > +CVE: CVE-2026-33814 > +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f] > + > +Backport Changes: > +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because > + their x/net version updates are not required for this focused backport. Hi Hetvi, Yoann, My Go knowledge is limited, but omitting the go.mod/go.sum changes didn't seem right to me. Those files track dependencies. Looking in to it a bit further, the CVE description is: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. The commit message is "all: update x/net to a9171bc8", if we look at that commit in the x/net go module [1] it makes other changes which look relevant to this CVE. [1]: https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/ Could we check if the backport submitted here is a complete fix? As I say, my Go knowledge is limited, and I'm not sure how we would pick up changes to the x/net module if we need to. Best regards, -- Paul Barker ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 2026-09-17 13:58 ` [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Paul Barker @ 2026-10-19 9:52 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-19 11:09 ` Paul Barker 0 siblings, 1 reply; 5+ messages in thread From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 9:52 UTC (permalink / raw) To: Paul Barker, openembedded-core@lists.openembedded.org Cc: xe-linux-external (Internal Group), Yoann Congal [-- Attachment #1: Type: text/plain, Size: 4588 bytes --] Hi Paul, Yoann, Thanks for the review. The go.mod, go.sum, and vendor/modules.txt changes are not required for this Go 1.22 backport, as the upstream Go 1.25 commit updates the entire x/net dependency to revision a9171bc8 [1]. For Go 1.22, the required security fix is applied directly to src/net/http/h2_bundle.go [2]. The fix addresses the infinite CONTINUATION frame loop described in the CVE. Updating only the dependency metadata without updating the complete vendored x/net source would be inconsistent. Since this is a focused security backport, the dependency update is not needed. The additional validation-related change in the upstream commit is not applicable to Go 1.22, as the corresponding code is not present in this version [2]. References: [1] https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/ [2] https://github.com/golang/go/blob/go1.22.12/src/net/http/h2_bundle.go Regards, Hetvi ________________________________ From: Paul Barker <paul@pbarker.dev> Sent: 17 September 2026 19:28 To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>; Yoann Congal <yoann.congal@smile.fr> Subject: Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 On Sun, 2026-08-30 at 23:14 -0700, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > From: Hetvi Thakar <hthakar@cisco.com> > > This patch applies the upstream fix as referenced in [2], > using the commit shown in [1]. > > [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f > [2] https://pkg.go.dev/vuln/GO-2026-4918 > > Signed-off-by: Hetvi Thakar <hthakar@cisco.com> > --- > meta/recipes-devtools/go/go-1.22.12.inc | 1 + > .../go/go/CVE-2026-33814.patch | 44 +++++++++++++++++++ > 2 files changed, 45 insertions(+) > create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch > > diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc > index 99c5f8b63b..ee2f5ca277 100644 > --- a/meta/recipes-devtools/go/go-1.22.12.inc > +++ b/meta/recipes-devtools/go/go-1.22.12.inc > @@ -62,6 +62,7 @@ SRC_URI += "\ > file://CVE-2026-25679.patch \ > file://CVE-2026-32288.patch \ > file://CVE-2026-27145.patch \ > + file://CVE-2026-33814.patch \ > " > SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" > > diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch > new file mode 100644 > index 0000000000..8265bf205f > --- /dev/null > +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch > @@ -0,0 +1,44 @@ > +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001 > +From: Mark Freeman <mark@golang.org> > +Date: Fri, 17 Apr 2026 16:28:03 -0400 > +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8 > + > +Fixes #78477 > + > +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f > +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323 > +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> > +TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com> > + > +CVE: CVE-2026-33814 > +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f] > + > +Backport Changes: > +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because > + their x/net version updates are not required for this focused backport. Hi Hetvi, Yoann, My Go knowledge is limited, but omitting the go.mod/go.sum changes didn't seem right to me. Those files track dependencies. Looking in to it a bit further, the CVE description is: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. The commit message is "all: update x/net to a9171bc8", if we look at that commit in the x/net go module [1] it makes other changes which look relevant to this CVE. [1]: https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/ Could we check if the backport submitted here is a complete fix? As I say, my Go knowledge is limited, and I'm not sure how we would pick up changes to the x/net module if we need to. Best regards, -- Paul Barker [-- Attachment #2: Type: text/html, Size: 9810 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 2026-10-19 9:52 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-19 11:09 ` Paul Barker 0 siblings, 0 replies; 5+ messages in thread From: Paul Barker @ 2026-10-19 11:09 UTC (permalink / raw) To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco), openembedded-core@lists.openembedded.org Cc: xe-linux-external (Internal Group), Yoann Congal On Mon, 2026-10-19 at 09:52 +0000, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > Hi Paul, Yoann, > > Thanks for the review. > > The go.mod, go.sum, and vendor/modules.txt changes are not required for this Go 1.22 backport, as the upstream Go 1.25 commit updates the entire x/net dependency to revision a9171bc8 [1]. > > For Go 1.22, the required security fix is applied directly to src/net/http/h2_bundle.go [2]. The fix addresses the infinite CONTINUATION frame loop described in the CVE. > > Updating only the dependency metadata without updating the complete vendored x/net source would be inconsistent. Since this is a focused security backport, the dependency update is not needed. > > The additional validation-related change in the upstream commit is not applicable to Go 1.22, as the corresponding code is not present in this version [2]. > > References: > [1] https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/ > [2] https://github.com/golang/go/blob/go1.22.12/src/net/http/h2_bundle.go Hi Hetvi, If you've checked this and you're confident that the go.mod/go.sum changes are not needed then this patch can go ahead. Best regards, -- Paul Barker ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-19 11:09 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-31 6:14 [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-08-31 6:14 ` [OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823 Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-09-17 13:58 ` [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814 Paul Barker 2026-10-19 9:52 ` Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) 2026-10-19 11:09 ` Paul Barker
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox