commit f893f2702891503a0c7ff615af3abb5efc1c480d [browse]
Author: Gopher Robot
Date: 2026-08-13 10:29:33 -07:00

[release-branch.go1.25] go1.25.13

Change-Id: I4b70d995adc305fd68e4dfc6bc5c42cd001513b5
Reviewed-on: https://go-review.googlesource.com/c/go/+/814722
Reviewed-by: Mark Freeman <mark@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>

commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569 [browse]
Author: Neal Patel
Date: 2026-08-07 00:23:22 Z

[release-branch.go1.25] cmd/vendor: fix CVE-2026-56865 in x/mod

Fixes #80744
Fixes CVE-2026-56865

Change-Id: I1e063053041c2d88b7801bfe09b6060f4def6afe
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5140
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5220
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814822
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit 22e01669cdcabb9cfad02e0c2bffbce8198f6bfb [browse]
Author: Neal Patel
Date: 2026-08-07 00:25:05 Z

[release-branch.go1.25] cmd/vendor: fix CVE-2026-56864 in x/mod

Fixes #80745
Fixes CVE-2026-56864

Change-Id: Ia60dafca958d02a7ee0ec45d49e1db001c79d981
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5121
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5240
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814821
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <mark@golang.org>

commit 8d01cbaad59021bd6d4f6e2dd864413872434250 [browse]
Author: Ian Alexander
Date: 2026-06-08 12:56:36 -04:00

[release-branch.go1.25] encoding/asn1: enforce maximum recursion depth

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.

Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this
issue.

Fixes CVE-2026-33818
Fixes #80405

Change-Id: Ic78d104432f8665a2949b95935fea23b5e35cff7
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4780
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5261
Reviewed-on: https://go-review.googlesource.com/c/go/+/814820
Reviewed-by: Mark Freeman <mark@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Gopher Robot <gobot@golang.org>

commit b952d04e2ab03d7b9049b2909e66dc91707089b4 [browse]
Author: Ian Alexander
Date: 2026-07-20 16:39:59 -04:00

[release-branch.go1.25] encoding/xml: fix depth processing in (*Decoder).unmarshal

(*Decoder).DecodeElement bypassed recursion depth guard by unilaterally
passing the constant 0 to (*Decoder).unmarshal. Previously, unmarshal
depth was tracked via a depth parameter passed down the call stack,
which manual loops inside custom UnmarshalXML methods could bypass.

This change simplifies depth tracking by maintaining a stack depth value
that is adjusted as start elements are pushed / popped. This eliminates
the need to reason about and synchronize two different values storing
the unmarshal depth.

Additionally, guarding (*Decoder).RawToken using parser stack state
broke streaming decoders reading tokens within open XML elements. This
change simplifies the guard by adding an explicit inUnmarshalXML flag.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

Updates #80481
Fixes #80627
Fixes CVE-2026-56859

Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Reviewed-on: https://go-review.googlesource.com/c/go/+/803320
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit ccb0514cb7ff74c1104579f7945a806630dac73e)
Reviewed-on: https://go-review.googlesource.com/c/go/+/807520