Advisories ยป MGASA-2026-0341

Updated golang packages fix security vulnerabilities

Publication date: 30 Aug 2026
Modification date: 30 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56865 , CVE-2026-56864 , CVE-2026-56859 , CVE-2026-56853 , CVE-2026-56860 , CVE-2026-46600 , CVE-2026-56862 , CVE-2026-56858 , CVE-2026-39821 , CVE-2026-33818

Description

CVE-2026-56865  A malicious GOPROXY was previously capable of forging up
to two sumdb tiles that allow for a requested module to bypass the
GOSUMDB check and persist attacker-controlled module content to a local
Go module cache.
CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency log.
CVE-2026-56859 Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56853 When a server is configured to support unencrypted
HTTP/2, it reads a few bytes from each new connection to see if they
contain the HTTP/2 client preface. Previously, this was being done with
no timeout applied. ReadHeaderTimeout is now applied for this.
CVE-2026-56860 Previously, resolving relative paths containing parent
directory (|..|) segments performed string conversions and buffer
rewrites on each step, resulting in quadratic time complexity and high
memory allocation overhead.
CVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the
size of a parameter value overflows the message buffer.
CVE-2026-56862 Previously, we always counted handshake messages, such as
KeyUpdate, as state-advancing, regardless of whether a handshake has
been completed or not. As a result, a malicious client can keep sending
KeyUpdate messages to force the server to keep performing key derivation
operations indefinitely.
CVE-2026-56858 Previously, pathological inputs could close an unescaped
|/| early, allowing for attack-controlled data to inject arbitrary
content, potentially leading to XSS.
CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted
Punycode-encoded labels that decode to an ASCII-only label. For example,
ToUnicode("xn--example-.com") incorrectly returned the name
"example.com" rather than an error.
CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack
exhaustion when parsing deeply-nested, recursive structures.

References

SRPMS

10/core

9/core