Your message dated Tue, 4 Aug 2026 19:59:30 +0200
with message-id <[email protected]>
and subject line Re: Accepted golang-golang-x-text 0.40.0-1 (source) into
unstable
has caused the Debian Bug report #1142674,
regarding golang-golang-x-text: CVE-2026-56852
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142674: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142674
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-golang-x-text
Version: 0.36.0-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/golang/go/issues/80142
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for golang-golang-x-text.
CVE-2026-56852[0]:
| A norm.Iter can enter an infinite loop when handling input
| containing invalid UTF-8 bytes.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-56852
https://www.cve.org/CVERecord?id=CVE-2026-56852
[1] https://github.com/golang/go/issues/80142
[2]
https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: golang-golang-x-text
Source-Version: 0.40.0-1
This fixed CVE-2026-56852 / #1142674 .
On Tue, Aug 04, 2026 at 04:20:31AM +0000, Debian FTP Masters wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Format: 1.8
> Date: Tue, 04 Aug 2026 04:36:02 +0100
> Source: golang-golang-x-text
> Architecture: source
> Version: 0.40.0-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian Go Packaging Team <[email protected]>
> Changed-By: Nick Morrott <[email protected]>
> Changes:
> golang-golang-x-text (0.40.0-1) unstable; urgency=medium
> .
> * Team upload.
> * New upstream version 0.40.0
> * d/control:
> - Remove myself from Uploaders
> - Bump debhelper compatibility level to 14
> - Refresh Build-Depends
> - Drop unnecessary ${misc:Depends} substvar
> * d/copyright:
> - Refresh years of Debian copyright
> * d/rules:
> - Drop unnecessary arguments to dh
> * d/gitlab-ci.yml:
> - Drop old Salsa CI configuration file
> * d/salsa-ci.yml:
> - Add latest Salsa CI configuration
> Checksums-Sha1:
> b580fa163e783071840c1d550469949ae64995bd 2193
> golang-golang-x-text_0.40.0-1.dsc
> ef9243b08183cb20c4f2fe2a72f3844d63d5ca12 6772356
> golang-golang-x-text_0.40.0.orig.tar.gz
> 62692bda67fde2e07d0dbf8161ced8e1da58d29b 7464
> golang-golang-x-text_0.40.0-1.debian.tar.xz
> a52c02fd86741e28972f514edb357ff7c469d955 5791
> golang-golang-x-text_0.40.0-1_amd64.buildinfo
> Checksums-Sha256:
> 420cf6ea4798a86640f245684f1fbfd6fc30be83709686e3a627c937ffe2fe22 2193
> golang-golang-x-text_0.40.0-1.dsc
> ea77ca323d0196e9c2e2d60a5b00fc3347918e9045a18d025af2d9c3596a2095 6772356
> golang-golang-x-text_0.40.0.orig.tar.gz
> 5c731a08db29b77afc02d10d63bd0cc6fa02e04654d6e456580e035857c9c8d1 7464
> golang-golang-x-text_0.40.0-1.debian.tar.xz
> b0dba2776848f8bcf64834e32ebeb3594deec2a02145645e05a103025773f152 5791
> golang-golang-x-text_0.40.0-1_amd64.buildinfo
> Files:
> 3a6cb810211f0efe3c2498fd13828811 2193 golang optional
> golang-golang-x-text_0.40.0-1.dsc
> 4f5c1e9db335a18b24881d3970001217 6772356 golang optional
> golang-golang-x-text_0.40.0.orig.tar.gz
> 94e6a39e899cab03d708cd85e09e9a72 7464 golang optional
> golang-golang-x-text_0.40.0-1.debian.tar.xz
> 87ca45ce89f44ca7e409ecdfbdbf01a0 5791 golang optional
> golang-golang-x-text_0.40.0-1_amd64.buildinfo
>
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAEBCgAdFiEEIrPZe+nomMkP9lI7PptZrG7C01kFAmpxYk0ACgkQPptZrG7C
> 01k4dw//aEyiYvBicT9tOtA/QQ7Y7GauF8PCM9/m0pS695AvJiE+nAbFPsJVddEg
> e9XdDlhImD6o2iaud+2B5YpMDkTScwFxWz4sLsPuLtqwpcmxCrtYUWGvY7F/Jxev
> 9VaH6B0OgKUvXLJ0NXOKGtlH/qcKgKefWULvKLIiVJxBJxlN2UWmRqpv2moAmj8q
> 2GLa73EsnEWD6YariAQHqOt2l/mgrS00RBQ9fKwrtCnOghumUqKKFSkzkHVhvn4u
> 5D8Y+ZXCBW6fMuGZd5husKaAFj08ky6Xj+ka3HTgC/KMRDApGsoHP9JfDGpzVKVr
> GqFAWTbt5iPgwg7ZWuh6Be+yqDmo+MBbDDuTyKtKG5lT1gTKuedsVAypnDIrS07q
> Tf3rhTxpK00n38c/46E1GEg9wOYtSC02rwV/NXQEZG4U0dZKgCD/MkYBBnT9c6vP
> ubE1+SRkvluW1tyhQ9UiNwpE08ejmMi2ehKqn7+YsfbjqlN0y3CVAXFEptWbeW7j
> 6HugbS+GDsYu1giWOaBBViyl4IY72j7gcznE+17ooN2yQwWqmG6o7M1HgZsOfuSa
> JAWezy+4hc1wV1+Tgr6lu005G89xxf+a/bf0JE0WSYs6jg+KTZfgACwY8EMyp4B2
> O15jMZFqaL2c5pux+03KFomZ2cyfyfYN23CFR5UmPp84W/XFxjg=
> =HTr6
> -----END PGP SIGNATURE-----
--- End Message ---
