Search results

net/textproto: excessive CPU consumption in Reader.ReadResponse (CVE-2025-61724) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75717 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

crypto/x509: quadratic complexity when checking name constraints (CVE-2025-58187) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75714 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

net/url: insufficient validation of bracketed IPv6 hostnames (CVE-2025-47912) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75712 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

archive/tar: unbounded allocation when parsing GNU sparse map (CVE-2025-58183) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75710 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

encoding/pem: quadratic complexity when parsing some invalid inputs (CVE-2025-61723) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75708 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75706 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion (CVE-2025-58185) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75704 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

crypto/x509: panic when validating certificates with DSA public keys (CVE-2025-58188) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75702 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

net/mail: excessive CPU consumption in ParseAddress (CVE-2025-61725) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75700 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.24.8

crypto/tls: ALPN negotiation error contains attacker controlled information [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

Security

Status: Closed (completed).

#75660 In golang/go;

· by gopherbot was closed on Oct 1, 2025

· 

Go1.24.8

sync/atomic: comment for Uintptr.Or incorrectly describes return value [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

compiler/runtimeIssues related to the Go compiler and/or runtime.Issues related to the Go compiler and/or runtime.

DocumentationIssues describing a change to documentation.Issues describing a change to documentation.

Status: Closed (completed).

#75609 In golang/go;

· by gopherbot was closed on Oct 1, 2025

· 

Go1.24.8

cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

compiler/runtimeIssues related to the Go compiler and/or runtime.Issues related to the Go compiler and/or runtime.

Status: Closed (completed).

#75594 In golang/go;

· by gopherbot was closed on Oct 1, 2025

· 

Go1.24.8