[Git][security-tracker-team/security-tracker][master] 2 commits: golang bookworm triagging
Bastien Roucariès (@rouca)
rouca at debian.org
Sun Oct 11 18:40:16 BST 2026
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker
Commits:
519c67e9 by Bastien Roucariès at 2026-10-11T19:35:19+02:00
golang bookworm triagging
- - - - -
f8e116c7 by Bastien Roucariès at 2026-10-11T19:39:33+02:00
[bookworm] - golang-golang-x-net
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2682,7 +2682,9 @@ CVE-2026-97032 (HTTP/2 servers could end up crashing due to inadvertently modify
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [bookworm] - golang-golang-x-net <postponed> (minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81867
NOTE: Fixed by: https://github.com/golang/go/commit/12acaf3086437e140e2dd3b7d2c30fdd633c5fe0 (go1.27.2)
@@ -2695,7 +2697,9 @@ CVE-2026-78659 (When "Trailer" headers are sent by a client, the HTTP server int
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [bookworm] - golang-golang-x-net <postponed> (minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81857
NOTE: Fixed by: https://github.com/golang/go/commit/cbb0fb8b51cba866018b8a0fb4b5458f16c5c80b (go1.27.2)
@@ -2708,6 +2712,7 @@ CVE-2026-97031 (Multiple ECH outer extension references are not permitted under
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81855
NOTE: Fixed by: https://github.com/golang/go/commit/f022e61963529d5e691f0e42a87fd5b520f01636 (go1.27.2)
@@ -2719,6 +2724,7 @@ CVE-2026-94444 (Previously, a user operating inside of a malicious Go project th
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81833
NOTE: Fixed by: https://github.com/golang/go/commit/1e4f1fec6fb468a23979823b8c3cbec5c8fca1af (go1.27.2)
@@ -2730,6 +2736,7 @@ CVE-2026-94447 (Previously, a user operating inside of a malicious Go project th
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81834
NOTE: Fixed by: https://github.com/golang/go/commit/68fa7699a27d745f90bf8630202e1a415d1b0769 (go1.27.2)
@@ -2741,6 +2748,7 @@ CVE-2026-94448 (When a JavaScript template literal contains consecutive expressi
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81821
NOTE: Fixed by: https://github.com/golang/go/commit/b26d150e6985f804826f4fcb1aa33aa81e700b52 (go1.27.2)
@@ -2752,6 +2760,7 @@ CVE-2026-97030 (A trusted template author may have previously written a valid te
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81823
NOTE: Fixed by: https://github.com/golang/go/commit/6e2cfab0a1c1683c52f9e09270627b0c4e6446e3 (go1.27.2)
@@ -2763,6 +2772,7 @@ CVE-2026-94440 (Parsing a multipart form can bypass memory limits and read an ar
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81741
NOTE: Fixed by: https://github.com/golang/go/commit/7c79b50a74b6d1aa4269b1827dda7d81f3717f9d (go1.27.2)
@@ -2774,6 +2784,7 @@ CVE-2026-56866 (When http.Transport sends an HTTP/1 CONNECT request with a non-e
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81740
NOTE: Fixed by: https://github.com/golang/go/commit/76875df0f3425f69e4dc2c439040a248b6107854 (go1.27.2)
@@ -2785,6 +2796,7 @@ CVE-2026-94439 (When an HTTP server handler sends a 2xx response to an HTTP/1 CO
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81744
NOTE: Fixed by: https://github.com/golang/go/commit/e92229e24a387cc006a750af176b07a459ba71a1 (go1.27.2)
@@ -2796,7 +2808,9 @@ CVE-2026-78669 (A malicious HTTP/2 peer can cause excessive CPU consumption in t
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81742
NOTE: Fixed by: https://github.com/golang/go/commit/1d58cdaa1069e259b60c324ec77472f09f23d92e (go1.27.2)
@@ -2809,7 +2823,9 @@ CVE-2026-78660 (Historically, we have been rather lax about malformed framing-re
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81115
NOTE: Fixed by: https://github.com/golang/go/commit/072779d81582543bf2872c259e0c6cceea728de4 (go1.27.2)
@@ -2829,6 +2845,7 @@ CVE-2026-78667 (When parsing a Range header containing a large number of small r
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81858
NOTE: Fixed by: https://github.com/golang/go/commit/ababc3cd873d8acce1777268aa7a817e6b672028 (go1.27.2)
@@ -2840,7 +2857,9 @@ CVE-2026-78663 (The HTTP/2 server can refund connection-level flow control twice
- golang-1.24 <removed>
[trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
+ [bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81743
NOTE: Fixed by: https://github.com/golang/go/commit/31dc9e2449e394439498142451627af52626d7c4 (go1.27.2)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/53dd23d1fb318a8ed3f0a2085bd59cbf6f091e14...f8e116c73f4fff14b056509ba585307619f969d4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/53dd23d1fb318a8ed3f0a2085bd59cbf6f091e14...f8e116c73f4fff14b056509ba585307619f969d4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261011/03030b36/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list