Repository navigation
fix(security/HIGH/): Bump Go to 1.26.5 to address CVE-2026-39822 and CVE-2026-42505 [SECURITY] - #23393
Merged
jnewbigin merged 1 commit intoJul 22, 2026
Conversation
…VE-2026-42505 [SECURITY] Go 1.26.5 addresses two security issues: - CVE-2026-39822 (os): opening a file in an os.Root could follow a symlink to a location outside the root when the final path component is a symlink and the path ends in "/". - CVE-2026-42505 (crypto/tls): the Encrypted Client Hello implementation leaked pre-shared-key identities during the handshake, allowing a passive network observer to intercept them.
jnewbigin
enabled auto-merge (squash)
July 22, 2026 02:18
paul1r
approved these changes
Jul 22, 2026
The Go 1.26.5 bump landed on
release-3.7.xas achore:commit (#23279), so release-please excludes it from the 3.7.4 changelog even though 1.26.5 is a Go security release. This records it under Bug Fixes as a security fix so it appears in the 3.7.4 notes.Go 1.26.5 addresses:
os) — HIGH: opening a file in anos.Rootcould follow a symlink to a location outside the root when the final path component is a symlink and the path ends in/.crypto/tls) — MEDIUM: the Encrypted Client Hello implementation leaked pre-shared-key identities during the handshake to a passive network observer.Filed at the higher of the two severities (HIGH). This is an empty commit; its only purpose is the changelog entry — the actual toolchain/version bump already merged in #23279.
Merge this before the 3.7.4 release PR (#22778) so release-please folds it into the refreshed release notes.