Hello gophers, We have just released go1.27rc2, a release candidate version of Go 1.27. It is cut from release-branch.go1.27 at the revision tagged go1.27rc2.
This release includes 2 security fixes following the security policy <https://go.dev/doc/security/policy>: - os: Root escape via symlink plus trailing slash On Unix systems, opening a file in an os.Root improperly followed symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, root.Open("symlink/") would open "symlink" even when "symlink" is a symbolic link pointing outside of the root. On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks in path when path ends in a /. Root failed to account for this behavior, permitting paths with a trailing / to escape. It now properly sanitizes the path parameter provided to openat. Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue. This is CVE-2026-39822 and Go issue https://go.dev/issue/79005. - crypto/tls: Encrypted Client Hello privacy leak The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. This is CVE-2026-42505 and Go issue https://go.dev/issue/79282. Please try your production load tests and unit tests with the new version. Your help testing these pre-release versions is invaluable. Report any problems using the issue tracker: https://go.dev/issue/new Please consider opting in to Go telemetry <https://go.dev/doc/telemetry> if you haven't already. Go telemetry helps validate this release candidate and future Go releases. You can opt in by running the following command: $ go telemetry on If you have Go installed already, an easy way to try go1.27rc2 is by using the go command: $ go install golang.org/dl/go1.27rc2@latest $ go1.27rc2 download You can download binary and source distributions from the usual place: https://go.dev/dl/#go1.27rc2 To find out what has changed in Go 1.27, read the draft release notes: https://tip.golang.org/doc/go1.27 Cheers, Junyang and David for the Go team -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/golang-nuts/a207cee2.EAAACO9sr0sAAAAAAAAAA-p9MGIAAYKKSQYAAAAAADE8OwBqTV_y%40mailjet.com.
