Advisories ยป MGASA-2026-0497

Updated golang packages fix security vulnerabilities

Publication date: 13 Oct 2026
Modification date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-97032 , CVE-2026-78659 , CVE-2026-97031 , CVE-2026-94444 , CVE-2026-94447 , CVE-2026-94448 , CVE-2026-97030 , CVE-2026-94440 , CVE-2026-56866 , CVE-2026-94439 , CVE-2026-78669 , CVE-2026-78660 , CVE-2026-78667 , CVE-2026-78663

Description

net/http: HTTP/2 server crash due to HPACK encoder race
net/http: HTTP/2 server memory exhaustion due to Trailer headers
crypto/tls: reject malformed ECH outer extension references
cmd/go: checksum bypass for golang.org/fips140
cmd/go: checksum database bypass for golang.org/toolchain
html/template: reset context tracking on consecutive template
expressions
html/template: recognize |yield| as regexp preceder keyword
net/textproto, mime/multipart: memory limit bypass when parsing MIME
headers
net/http: HTTP/1 client connection desynchronization after CONNECT
rejection
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT
response
net/http: excessive CPU consumption from repeated initial window changes
net/http: HTTP/2 transport accepts malformed framing-related headers
net/http: lack of limit on size of parsed Range headers
net/http: double flow control refund on HTTP/2 server streams

References

SRPMS

10/core