{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0341",
  "published": "2026-08-30T04:17:09Z",
  "modified": "2026-08-30T03:13:37Z",
  "summary": "Updated golang packages fix security vulnerabilities",
  "details": "CVE-2026-56865  A malicious GOPROXY was previously capable of forging up\nto two sumdb tiles that allow for a requested module to bypass the\nGOSUMDB check and persist attacker-controlled module content to a local\nGo module cache.\nCVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary\nmodule content not contained within the transparency log.\nCVE-2026-56859 Previously, DecodeElement would reset the depth counter\ncausing it to never fire; this could lead to stack exhaustion.\nCVE-2026-56853 When a server is configured to support unencrypted\nHTTP/2, it reads a few bytes from each new connection to see if they\ncontain the HTTP/2 client preface. Previously, this was being done with\nno timeout applied. ReadHeaderTimeout is now applied for this.\nCVE-2026-56860 Previously, resolving relative paths containing parent\ndirectory (|..|) segments performed string conversions and buffer\nrewrites on each step, resulting in quadratic time complexity and high\nmemory allocation overhead.\nCVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the\nsize of a parameter value overflows the message buffer.\nCVE-2026-56862 Previously, we always counted handshake messages, such as\nKeyUpdate, as state-advancing, regardless of whether a handshake has\nbeen completed or not. As a result, a malicious client can keep sending\nKeyUpdate messages to force the server to keep performing key derivation\noperations indefinitely.\nCVE-2026-56858 Previously, pathological inputs could close an unescaped\n|/| early, allowing for attack-controlled data to inject arbitrary\ncontent, potentially leading to XSS.\nCVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted\nPunycode-encoded labels that decode to an ASCII-only label. For example,\nToUnicode(\"xn--example-.com\") incorrectly returned the name\n\"example.com\" rather than an error.\nCVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack\nexhaustion when parsing deeply-nested, recursive structures.\n",
  "upstream": [
    "CVE-2026-56865",
    "CVE-2026-56864",
    "CVE-2026-56859",
    "CVE-2026-56853",
    "CVE-2026-56860",
    "CVE-2026-46600",
    "CVE-2026-56862",
    "CVE-2026-56858",
    "CVE-2026-39821",
    "CVE-2026-33818"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0341.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36142"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/08/13/13"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "golang",
        "purl": "pkg:rpm/mageia/golang?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.13-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:9",
        "name": "golang",
        "purl": "pkg:rpm/mageia/golang?arch=source&distro=mageia-9"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.13-1.mga9"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}