RHSA-2026:12282

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.

The net/url package does not set a limit on the number of query parameters in a query.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.