Accepted golang-1.27 1.27.2-1 (source) into unstable

Debian FTP Masters Thu, 08 Oct 2026 13:38:30 -0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 08 Oct 2026 21:59:52 +0200
Source: golang-1.27
Architecture: source
Version: 1.27.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Compiler Team <[email protected]>
Changed-By: Dr. Tobias Quathamer <[email protected]>
Changes:
 golang-1.27 (1.27.2-1) unstable; urgency=medium
 .
   * New upstream version 1.27.2
     - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization
       after CONNECT rejection
     - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer
       headers
     - CVE-2026-78660: net/http/internal/http2: transport accepts multiple
       Content-Length headers
     - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server
       streams
     - CVE-2026-78667: net/http: lack of limit on size of parsed Range headers
     - CVE-2026-78669: net/http: excessive CPU consumption from repeated
       initial window changes
     - CVE-2026-94439: net/http: HTTP/1 server connection desynchronization
       after 2xx CONNECT response
     - CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when
       parsing MIME headers
     - CVE-2026-94444: cmd/go: malicious GOMODPROXY can cause
       golang.org/fips140 checksum bypass
     - CVE-2026-94447: cmd/go: malicious GOMODPROXY can cause
       golang.org/toolchain checksum bypass
     - CVE-2026-94448: html/template: reset context tracking on consecutive
       template expressions
     - CVE-2026-97030: html/template: XSS via missing ES2015+ keywords in
       regexpPrecederKeywords
     - CVE-2026-97031: crypto/tls: reject malformed ECH outer extension
       references
     - CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race
   * Do not insert an empty line in generated files.
   * Regenerate control files
   * Update d/watch to v5
   * Remove ppc64 from architectures, now uses ELFv2.
   * Remove architectures armel, mips, mips64el, mipsel.
   * Include Go 1.27 and 1.24 as possible candidates for Build-Depends
Checksums-Sha1:
 a8310daee08f9dff2984bd9e8520565c63898ed8 2915 golang-1.27_1.27.2-1.dsc
 354f83d5f490a42f7248b62674de62c0cbfae823 25034468 
golang-1.27_1.27.2.orig.tar.xz
 f45892a2c68a4f8f47d9317cc659a6d9a4a5ad03 48632 
golang-1.27_1.27.2-1.debian.tar.xz
 7c6ac44dab647801af8bc8ca06cf2ed98d3d189e 47453948 
golang-1.27_1.27.2-1.git.tar.xz
 6b39d7ba294ca08ae6232f433de78dd46b06cba6 17744 
golang-1.27_1.27.2-1_source.buildinfo
Checksums-Sha256:
 1051487fa72df0ebc9b8ecb8a6e2ba1afd07c78d7dd7379e0b0ec308b8012675 2915 
golang-1.27_1.27.2-1.dsc
 99f9f06c1988e31b1e838cdbc9932212d9320034bc9ea971592241d583c0e0dd 25034468 
golang-1.27_1.27.2.orig.tar.xz
 053414656bb57323678ad48b150cfbf674208685f8697c4eb8cfea6a255e86dd 48632 
golang-1.27_1.27.2-1.debian.tar.xz
 007176541a0dbb110acfba5ff4ceb3e33e9022a0a1b6c2b30b18e1dafbffdf09 47453948 
golang-1.27_1.27.2-1.git.tar.xz
 e4a9f1aa6fb0f7b93573152a52e05bdd7d32f52c172e5256b37db6972b035d12 17744 
golang-1.27_1.27.2-1_source.buildinfo
Files:
 c78c7601d69ee506d6ef6e4d82677798 2915 golang optional golang-1.27_1.27.2-1.dsc
 0ea7641678d8b23e9490757453ed1cc9 25034468 golang optional 
golang-1.27_1.27.2.orig.tar.xz
 980a24c5e28939cce4356abe46c044e0 48632 golang optional 
golang-1.27_1.27.2-1.debian.tar.xz
 43bbb0b09f61981727cb4911f46adaf1 47453948 None None 
golang-1.27_1.27.2-1.git.tar.xz
 b01c7bbc729a6deb8ffd9cfd527e0708 17744 golang optional 
golang-1.27_1.27.2-1_source.buildinfo
Git-Tag-Info: tag=3e4323013e83ea5fe3666fed312e07b132dc03d2 
fp=d1cb8f39bc5ded24c5d2c78c1302f1f036ebeb19
Git-Tag-Tagger: Dr. Tobias Quathamer <[email protected]>
pgp2fx5BIvQJu.pgp
Description: PGP signature
Accepted golang-1.27 1.27.2-1 (source) into unstable

Reply via email to
