-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 08 Oct 2026 21:45:25 +0200 Source: golang-1.26 Architecture: source Version: 1.26.9-1 Distribution: unstable Urgency: medium Maintainer: Debian Go Compiler Team <[email protected]> Changed-By: Dr. Tobias Quathamer <[email protected]> Changes: golang-1.26 (1.26.9-1) unstable; urgency=medium . * New upstream version 1.26.9 - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers - CVE-2026-78660: net/http/internal/http2: transport accepts multiple Content-Length headers - CVE-2026-78667: net/http: lack of limit on size of parsed Range headers - CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response - CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers - CVE-2026-94444: cmd/go: malicious GOMODPROXY can cause golang.org/fips140 checksum bypass - CVE-2026-94447: cmd/go: malicious GOMODPROXY can cause golang.org/toolchain checksum bypass - CVE-2026-94448: html/template: reset context tracking on consecutive template expressions - CVE-2026-97030: html/template: XSS via missing ES2015+ keywords in regexpPrecederKeywords - CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references - CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race Checksums-Sha1: 6d4ec54b000a43d656e34dce40ef0bb08c6301b0 2957 golang-1.26_1.26.9-1.dsc 264f1740f62d7e75aa563ff5db9d5b63aa6cc2ab 23231260 golang-1.26_1.26.9.orig.tar.xz abd86d356a64711b59716367e7209912e8d2a137 48728 golang-1.26_1.26.9-1.debian.tar.xz e0e79ccba16e2e298be49fe9f977daa5798c7ea2 45000516 golang-1.26_1.26.9-1.git.tar.xz a8f8e1458d723b91e141d2aa687c22ae19aa9490 17744 golang-1.26_1.26.9-1_source.buildinfo Checksums-Sha256: 18c79354f64e56f1b428128f9340b28b6d6bd61cac893a1445909a540131c2d5 2957 golang-1.26_1.26.9-1.dsc b052fd4c8ad1ba9b0ebecc64c8819e6244c36047d1dc45017fe43ff3e6e9ed00 23231260 golang-1.26_1.26.9.orig.tar.xz 0dd463e46c8840c366315224ba223008607e8f98057bfbd58c11df1cc27d4445 48728 golang-1.26_1.26.9-1.debian.tar.xz a288fcb848d7fa68510ee7aa722ccf812fc866063d94b260fdfe0fc6fb0faa37 45000516 golang-1.26_1.26.9-1.git.tar.xz 467329b1d64afef2ac05929b13bc778937db33a4a4822e098692a6c1d122d902 17744 golang-1.26_1.26.9-1_source.buildinfo Files: 63079df8acfa066daa067b3606e6166c 2957 golang optional golang-1.26_1.26.9-1.dsc 76e683218bb6f1bbb3e19efd47529b76 23231260 golang optional golang-1.26_1.26.9.orig.tar.xz 2e595ebb1b7c9b31349fd763dfe90846 48728 golang optional golang-1.26_1.26.9-1.debian.tar.xz 453ef529919fa478b888fd7ecc97cb60 45000516 None None golang-1.26_1.26.9-1.git.tar.xz a17feb832f81dcaf9580fb706b6cbeff 17744 golang optional golang-1.26_1.26.9-1_source.buildinfo Git-Tag-Info: tag=de6cd8b900010d84c25b3d6897d0ce380206e82e fp=d1cb8f39bc5ded24c5d2c78c1302f1f036ebeb19 Git-Tag-Tagger: Dr. Tobias Quathamer <[email protected]>
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrH9n0ACgkQYG0ITkaD wHnONw/+LW9+WN33JOZFxbszaIRFVGkgqC+awrVFoHPnKR3LFMo2BrOkgko3nRc6 GlUmJmAkc7i+2iQC5/XuY+GHy/AnsUWEQjn9TGGREKpe4swbaFYx6gOmu1TXnOmL 3RNwg6sfQ5H7znQRQJ7OwEofrvE9WpXNCt0phopb+9CekOljN5Y+gmNiIQYQPeID YqXoj/saSRyWlHQl0z4hM6aCG/y4Qng7e2nh1Q1JrenoiylHcccIo8PNESBwM8yJ upZRI7ftp/oK8WMe40GpkKuF/5AC8qmd6HGA7HTfTF/EWfJkL+5eh0SH42LNY9cu 1muBMXz9t3w9RGrL/T8iiMhlYEc8OcblD/htkRAKWFFXV4Zh20CwSK7pg8DTZO4i nkycP+M4XiRLabT9vhoBnoo0gXhM72bYHCBsqIS8FYCBIuam6I/kUzhT5ILfDJ3T 7bPSwj9jbRwAgQKRz1t0tOJuR1dyC1NRLPT0C3GsIl9lPiHMUCZa4VC5GMuKHyFJ 6kkTRxKHDj9s32OsbwtwFzTux0DW/oD6SLXnfHh1zpR3l3ZvvBBttVn9veMF6iCo i2PyZ3xn4D7rBSKd0CctNE0AqmEKLmXX8WEc4jBx63D/ANXsxK7BpkCBdEkupIKJ 9qQV8zcdZLfXQe5JWaYsM5kKqm5DBxdt23m9+1siEBX98mMJ/hU= =tGXn -----END PGP SIGNATURE-----
pgpnIv5uV4BsY.pgp
Description: PGP signature
