commit 1ea5a71ad8ceb7b9f16b4b6f8ea4739a4327dd6e [browse]
Author: Gopher Robot
Date: 2026-08-13 10:14:20 -07:00

[release-branch.go1.26] go1.26.6

Change-Id: I04258bea694def9a16dd544fba28fea45eeadbbb
Reviewed-on: https://go-review.googlesource.com/c/go/+/814840
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

commit 115eb476aaca4531374c42e19e6f199265c2e25e [browse]
Author: Neal Patel
Date: 2026-08-07 00:23:22 Z

[release-branch.go1.26] cmd/vendor: fix CVE-2026-56865 in x/mod

Fixes #80744
Fixes CVE-2026-56865

Change-Id: I1e063053041c2d88b7801bfe09b6060f4def6afe
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5140
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5200
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814802
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit 9f6980fd5c03840b0f6764e8ec7c705b90989eee [browse]
Author: Neal Patel
Date: 2026-08-07 00:25:05 Z

[release-branch.go1.26] cmd/vendor: fix CVE-2026-56864 in x/mod

Fixes #80745
Fixes CVE-2026-56864

Change-Id: Ia60dafca958d02a7ee0ec45d49e1db001c79d981
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5121
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5201
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814801
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit 6ec908dd240103f222620a222bc8a4c3e2c33718 [browse]
Author: Ian Alexander
Date: 2026-06-08 12:56:36 -04:00

[release-branch.go1.26] encoding/asn1: enforce maximum recursion depth

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.

Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this
issue.

Fixes CVE-2026-33818
Fixes #80405

Change-Id: Ic78d104432f8665a2949b95935fea23b5e35cff7
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4780
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5260
Reviewed-on: https://go-review.googlesource.com/c/go/+/814800
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Mark Freeman <mark@golang.org>

commit 9918f26ab31a6bf9209ecc06465cab0e287e90f1 [browse]
Author: Ian Alexander
Date: 2026-07-20 16:39:59 -04:00

[release-branch.go1.26] encoding/xml: fix depth processing in (*Decoder).unmarshal

(*Decoder).DecodeElement bypassed recursion depth guard by unilaterally
passing the constant 0 to (*Decoder).unmarshal. Previously, unmarshal
depth was tracked via a depth parameter passed down the call stack,
which manual loops inside custom UnmarshalXML methods could bypass.

This change simplifies depth tracking by maintaining a stack depth value
that is adjusted as start elements are pushed / popped. This eliminates
the need to reason about and synchronize two different values storing
the unmarshal depth.

Additionally, guarding (*Decoder).RawToken using parser stack state
broke streaming decoders reading tokens within open XML elements. This
change simplifies the guard by adding an explicit inUnmarshalXML flag.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

Updates #80481
Fixes #80628
Fixes CVE-2026-56859

Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Reviewed-on: https://go-review.googlesource.com/c/go/+/803320
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit ccb0514cb7ff74c1104579f7945a806630dac73e)
Reviewed-on: https://go-review.googlesource.com/c/go/+/807540