[OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f
[2] https://pkg.go.dev/vuln/GO-2026-4918

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/go/go-1.22.12.inc       |  1 +
 .../go/go/CVE-2026-33814.patch                | 44 +++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch

diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index 99c5f8b63b..ee2f5ca277 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -62,6 +62,7 @@ SRC_URI += "\
     file://CVE-2026-25679.patch \
     file://CVE-2026-32288.patch \
     file://CVE-2026-27145.patch \
+    file://CVE-2026-33814.patch \
 "
 SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
 
diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
new file mode 100644
index 0000000000..8265bf205f
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
@@ -0,0 +1,44 @@
+From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001
+From: Mark Freeman <mark@golang.org>
+Date: Fri, 17 Apr 2026 16:28:03 -0400
+Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8
+
+Fixes #78477
+
+Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f
+Reviewed-on: https://go-review.googlesource.com/c/go/+/768323
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com>
+
+CVE: CVE-2026-33814
+Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f]
+
+Backport Changes:
+- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because
+  their x/net version updates are not required for this focused backport.
+- Omitted removal of the SETTINGS_ENABLE_CONNECT_PROTOCOL-specific
+  s.Valid call because Go 1.22 does not contain that setting case; validation
+  is added at the start of the settings callback instead.
+
+(cherry picked from commit 9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/net/http/h2_bundle.go | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
+index c1a2e76ea4d..2f5a6d3d5a2 100644
+--- a/src/net/http/h2_bundle.go
++++ b/src/net/http/h2_bundle.go
+@@ -9910,6 +9910,9 @@ func (rl *http2clientConnReadLoop) processSettingsNoWrite(f *http2SettingsFrame)
+ 
+ 	var seenMaxConcurrentStreams bool
+ 	err := f.ForeachSetting(func(s http2Setting) error {
++		if err := s.Valid(); err != nil {
++			return err
++		}
+ 		switch s.ID {
+ 		case http2SettingMaxFrameSize:
+ 			cc.maxFrameSize = s.Val
+-- 
+2.35.6
-- 
2.35.6

[OE-core][scarthgap][PATCH 2/2] go: Fix CVE-2026-39823

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811
[2] https://pkg.go.dev/vuln/GO-2026-4982

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/go/go-1.22.12.inc       |   1 +
 .../go/go/CVE-2026-39823.patch                | 100 ++++++++++++++++++
 2 files changed, 101 insertions(+)
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch

diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index ee2f5ca277..a2c0efa378 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -63,6 +63,7 @@ SRC_URI += "\
     file://CVE-2026-32288.patch \
     file://CVE-2026-27145.patch \
     file://CVE-2026-33814.patch \
+    file://CVE-2026-39823.patch \
 "
 SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
 
diff --git a/meta/recipes-devtools/go/go/CVE-2026-39823.patch b/meta/recipes-devtools/go/go/CVE-2026-39823.patch
new file mode 100644
index 0000000000..00e25bb35c
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2026-39823.patch
@@ -0,0 +1,100 @@
+From 4915efb53a017a136a233a7676e80858d5b6e560 Mon Sep 17 00:00:00 2001
+From: Neal Patel <nealpatel@google.com>
+Date: Wed, 22 Apr 2026 18:41:25 -0400
+Subject: [PATCH] [release-branch.go1.25] html/template: fix escaping of URLs
+ in meta content attributes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The WHATWG "shared declarative refresh steps" algorithm (§4.2.5.3)
+skips ASCII whitespace between "url" and "=" when parsing the URL
+portion of a meta content attribute.
+
+Thank you to Samy Ghannad for reporting this issue.
+
+Updates #78913
+Fixes #79031
+Fixes CVE-2026-39823
+
+Change-Id: I7fc3bb9394b95e07b9b10fbc95725a3de6791774
+Reviewed-on: https://go-review.googlesource.com/c/go/+/769920
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+TryBot-Bypass: Roland Shoemaker <roland@golang.org>
+(cherry picked from commit f2ec1254ff32fa39f3ce4faf72bbe44eeeeebad9)
+Reviewed-on: https://go-review.googlesource.com/c/go/+/772101
+LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+
+CVE: CVE-2026-39823
+Upstream-Status: Backport [https://github.com/golang/go/commit/f0384f7c664892ed3ee8c0fec68638d9b3b01811]
+
+(cherry picked from commit f0384f7c664892ed3ee8c0fec68638d9b3b01811)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ src/html/template/escape_test.go | 20 ++++++++++++++++++++
+ src/html/template/transition.go  | 12 +++++++-----
+ 2 files changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/src/html/template/escape_test.go b/src/html/template/escape_test.go
+index ce064407384..c9e566a9076 100644
+--- a/src/html/template/escape_test.go
++++ b/src/html/template/escape_test.go
+@@ -759,6 +759,26 @@ func TestEscape(t *testing.T) {
+ 			`<meta http-equiv="refresh" content="{{"asd: 123"}}">`,
+ 			`<meta http-equiv="refresh" content="asd: 123">`,
+ 		},
++		{
++			"meta content url with whitespace before equals",
++			`<meta http-equiv="refresh" content="0;url ={{"javascript:alert(1)"}}">`,
++			`<meta http-equiv="refresh" content="0;url =#ZgotmplZ">`,
++		},
++		{
++			"meta content url with tab before equals",
++			"<meta http-equiv=\"refresh\" content=\"0;url\t={{\"javascript:alert(1)\"}}\">",
++			"<meta http-equiv=\"refresh\" content=\"0;url\t=#ZgotmplZ\">",
++		},
++		{
++			"meta content url with space after equals",
++			`<meta http-equiv="refresh" content="0;url= {{"javascript:alert(1)"}}">`,
++			`<meta http-equiv="refresh" content="0;url= #ZgotmplZ">`,
++		},
++		{
++			"meta content url with whitespace both sides of equals",
++			"<meta http-equiv=\"refresh\" content=\"0;url \t= {{\"javascript:alert(1)\"}}\">",
++			"<meta http-equiv=\"refresh\" content=\"0;url \t= #ZgotmplZ\">",
++		},
+ 	}
+ 
+ 	for _, test := range tests {
+diff --git a/src/html/template/transition.go b/src/html/template/transition.go
+index 5aa3c35440b..ac05d56b418 100644
+--- a/src/html/template/transition.go
++++ b/src/html/template/transition.go
+@@ -626,10 +626,12 @@ func tError(c context, s []byte) (context, int) {
+ 
+ // tMetaContent is the context transition function for the meta content attribute state.
+ func tMetaContent(c context, s []byte) (context, int) {
+-	for i := 0; i < len(s); i++ {
+-		if i+3 <= len(s)-1 && bytes.Equal(bytes.ToLower(s[i:i+4]), []byte("url=")) {
+-			c.state = stateMetaContentURL
+-			return c, i + 4
++	for i := range len(s) {
++		if i+3 <= len(s)-1 && bytes.EqualFold(s[i:i+3], []byte("url")) {
++			if j := eatWhiteSpace(s, i+3); j < len(s) && s[j] == '=' {
++				c.state = stateMetaContentURL
++				return c, j + 1
++			}
+ 		}
+ 	}
+ 	return c, len(s)
+@@ -637,7 +639,7 @@ func tMetaContent(c context, s []byte) (context, int) {
+ 
+ // tMetaContentURL is the context transition function for the "url=" part of a meta content attribute state.
+ func tMetaContentURL(c context, s []byte) (context, int) {
+-	for i := 0; i < len(s); i++ {
++	for i := range len(s) {
+ 		if s[i] == ';' {
+ 			c.state = stateMetaContent
+ 			return c, i + 1
+-- 
+2.35.6
-- 
2.35.6

Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[Paul Barker]

On Sun, 2026-08-30 at 23:14 -0700, Hetvi Thakar -X (hthakar - E
INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
> 
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
> 
> [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f
> [2] https://pkg.go.dev/vuln/GO-2026-4918
> 
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-devtools/go/go-1.22.12.inc       |  1 +
>  .../go/go/CVE-2026-33814.patch                | 44 +++++++++++++++++++
>  2 files changed, 45 insertions(+)
>  create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch
> 
> diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
> index 99c5f8b63b..ee2f5ca277 100644
> --- a/meta/recipes-devtools/go/go-1.22.12.inc
> +++ b/meta/recipes-devtools/go/go-1.22.12.inc
> @@ -62,6 +62,7 @@ SRC_URI += "\
>      file://CVE-2026-25679.patch \
>      file://CVE-2026-32288.patch \
>      file://CVE-2026-27145.patch \
> +    file://CVE-2026-33814.patch \
>  "
>  SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
>  
> diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
> new file mode 100644
> index 0000000000..8265bf205f
> --- /dev/null
> +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
> @@ -0,0 +1,44 @@
> +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001
> +From: Mark Freeman <mark@golang.org>
> +Date: Fri, 17 Apr 2026 16:28:03 -0400
> +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8
> +
> +Fixes #78477
> +
> +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f
> +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323
> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
> +TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com>
> +
> +CVE: CVE-2026-33814
> +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f]
> +
> +Backport Changes:
> +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because
> +  their x/net version updates are not required for this focused backport.

Hi Hetvi, Yoann,

My Go knowledge is limited, but omitting the go.mod/go.sum changes
didn't seem right to me. Those files track dependencies.

Looking in to it a bit further, the CVE description is:

    When processing HTTP/2 SETTINGS frames, transport will enter an
    infinite loop of writing CONTINUATION frames if it receives a
    SETTINGS_MAX_FRAME_SIZE with a value of 0.

The commit message is "all: update x/net to a9171bc8", if we look at
that commit in the x/net go module [1] it makes other changes which look
relevant to this CVE.

[1]: https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/

Could we check if the backport submitted here is a complete fix? As I
say, my Go knowledge is limited, and I'm not sure how we would pick up
changes to the x/net module if we need to.

Best regards,

-- 
Paul Barker

Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 4588 bytes --]

Hi Paul, Yoann,

Thanks for the review.

The go.mod, go.sum, and vendor/modules.txt changes are not required for this Go 1.22 backport, as the upstream Go 1.25 commit updates the entire x/net dependency to revision a9171bc8 [1].

For Go 1.22, the required security fix is applied directly to src/net/http/h2_bundle.go [2]. The fix addresses the infinite CONTINUATION frame loop described in the CVE.

Updating only the dependency metadata without updating the complete vendored x/net source would be inconsistent. Since this is a focused security backport, the dependency update is not needed.

The additional validation-related change in the upstream commit is not applicable to Go 1.22, as the corresponding code is not present in this version [2].

References:
[1] https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/
[2] https://github.com/golang/go/blob/go1.22.12/src/net/http/h2_bundle.go

Regards,
Hetvi
________________________________
From: Paul Barker <paul@pbarker.dev>
Sent: 17 September 2026 19:28
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>; Yoann Congal <yoann.congal@smile.fr>
Subject: Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

On Sun, 2026-08-30 at 23:14 -0700, Hetvi Thakar -X (hthakar - E
INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> [1] https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f
> [2] https://pkg.go.dev/vuln/GO-2026-4918
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-devtools/go/go-1.22.12.inc       |  1 +
>  .../go/go/CVE-2026-33814.patch                | 44 +++++++++++++++++++
>  2 files changed, 45 insertions(+)
>  create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch
>
> diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
> index 99c5f8b63b..ee2f5ca277 100644
> --- a/meta/recipes-devtools/go/go-1.22.12.inc
> +++ b/meta/recipes-devtools/go/go-1.22.12.inc
> @@ -62,6 +62,7 @@ SRC_URI += "\
>      file://CVE-2026-25679.patch \
>      file://CVE-2026-32288.patch \
>      file://CVE-2026-27145.patch \
> +    file://CVE-2026-33814.patch \
>  "
>  SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
>
> diff --git a/meta/recipes-devtools/go/go/CVE-2026-33814.patch b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
> new file mode 100644
> index 0000000000..8265bf205f
> --- /dev/null
> +++ b/meta/recipes-devtools/go/go/CVE-2026-33814.patch
> @@ -0,0 +1,44 @@
> +From 825d42a14d8ffbdbdda87a39e78795eb17e4f0f2 Mon Sep 17 00:00:00 2001
> +From: Mark Freeman <mark@golang.org>
> +Date: Fri, 17 Apr 2026 16:28:03 -0400
> +Subject: [PATCH] [release-branch.go1.25] all: update x/net to a9171bc8
> +
> +Fixes #78477
> +
> +Change-Id: I0a4c8e25f569fc1bfb8ac39ff728bfe7300b751f
> +Reviewed-on: https://go-review.googlesource.com/c/go/+/768323
> +Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
> +TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com>
> +
> +CVE: CVE-2026-33814
> +Upstream-Status: Backport [https://github.com/golang/go/commit/9024c3f6b150fb1349d8a5dc5e9aa31d7896f67f]
> +
> +Backport Changes:
> +- Omitted src/go.mod, src/go.sum, and src/vendor/modules.txt because
> +  their x/net version updates are not required for this focused backport.

Hi Hetvi, Yoann,

My Go knowledge is limited, but omitting the go.mod/go.sum changes
didn't seem right to me. Those files track dependencies.

Looking in to it a bit further, the CVE description is:

    When processing HTTP/2 SETTINGS frames, transport will enter an
    infinite loop of writing CONTINUATION frames if it receives a
    SETTINGS_MAX_FRAME_SIZE with a value of 0.

The commit message is "all: update x/net to a9171bc8", if we look at
that commit in the x/net go module [1] it makes other changes which look
relevant to this CVE.

[1]: https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/

Could we check if the backport submitted here is a complete fix? As I
say, my Go knowledge is limited, and I'm not sure how we would pick up
changes to the x/net module if we need to.

Best regards,

--
Paul Barker


[-- Attachment #2: Type: text/html, Size: 9810 bytes --]

Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[Paul Barker]

On Mon, 2026-10-19 at 09:52 +0000, Hetvi Thakar -X (hthakar - E
INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Paul, Yoann,
> 
> Thanks for the review.
> 
> The go.mod, go.sum, and vendor/modules.txt changes are not required for this Go 1.22 backport, as the upstream Go 1.25 commit updates the entire x/net dependency to revision a9171bc8 [1].
> 
> For Go 1.22, the required security fix is applied directly to src/net/http/h2_bundle.go [2]. The fix addresses the infinite CONTINUATION frame loop described in the CVE.
> 
> Updating only the dependency metadata without updating the complete vendored x/net source would be inconsistent. Since this is a focused security backport, the dependency update is not needed.
> 
> The additional validation-related change in the upstream commit is not applicable to Go 1.22, as the corresponding code is not present in this version [2].
> 
> References:
> [1] https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/
> [2] https://github.com/golang/go/blob/go1.22.12/src/net/http/h2_bundle.go

Hi Hetvi,

If you've checked this and you're confident that the go.mod/go.sum
changes are not needed then this patch can go ahead.

Best regards,

-- 
Paul Barker