Several CVEs were fixed:
| Dependency | CVE | Summary |
|---|---|---|
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-27145 | Inefficient candidate hostname parsing in crypto/x509 |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-33818 | Enforce maximum recursion depth in encoding/asn1 |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-39822 | Root escape via symlink plus trailing slash in os |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-42504 | Quadratic complexity in WordDecoder.DecodeHeader in mime |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-42505 | Invoking Encrypted Client Hello privacy leak in crypto/tls |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-42507 | Arbitrary inputs are included in errors without any escaping in net/textproto |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-56853 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-56858 | Fix JavaScript regex context tracking in html/template |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-56859 | Add recursion depth guard during decode in encoding/xml |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-56860 | Avoid quadratic complexity in resolvePath in net/url |
| Go stdlib (1.26.3 → 1.26.7) | CVE-2026-56862 | Limit handshake messages accepted post-handshake in crypto/tls |
| go.opentelemetry.io/otel (v1.43.0 → v1.45.0) | CVE-2026-41178 | Baggage parsing no longer caps raw header length |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39827 | Invoking memory leak when rejecting channels can lead to DoS in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39828 | Invoking bypass of certificate restrictions in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39829 | Invoking pathological RSA/DSA parameters may cause DoS in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39830 | Invoking client can cause server deadlock on unexpected responses in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39831 | Invoking bypass of FIDO/U2F security keys physical interaction in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39832 | Invoking agent constraints dropped when forwarding keys in ssh/agent |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39833 | Invoking key constraints not enforced in ssh/agent |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39834 | Invoking infinite loop on large channel writes in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-39835 | Invoking server panic during CheckHostKey/Authenticate in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-42508 | Invoking auth bypass via unenforced @revoked status in ssh/knownhosts
|
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-46597 | Invoking byte arithmetic causes underflow and panic in ssh |
| golang.org/x/crypto (v0.51.0 → v0.55.0) | CVE-2026-46598 | Invoking pathological inputs can lead to client panic in ssh/agent |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in html |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in html |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-27136 | Invoking duplicate attributes can cause XSS in html |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in idna |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in html |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-42506 | Invoking incorrect handling of namespaced elements in foreign content in html |
| golang.org/x/net (v0.54.0 → v0.58.0) | CVE-2026-46600 | Parsing an invalid SVCB or HTTPS RR can panic in dns/dnsmessage |
| golang.org/x/text (v0.37.0 → v0.41.0) | CVE-2026-56852 | Infinite loop on invalid input |
| google.golang.org/grpc (v1.74.2 → v1.83.1) | CVE-2026-33186 | Authorization bypass via missing leading slash in :path |
| google.golang.org/grpc (v1.74.2 → v1.83.1) | GHSA-hrxh-6v49-42gf / GO-2026-6061 | Vulnerabilities in the xDS RBAC authorization engine and HTTP/2 transport |