commit 90cf2c38605cf6514cc395c9d94688c1154ffcda [browse]
Author: Gopher Robot
Date: 2026-08-13 10:30:25 -07:00

[release-branch.go1.27] go1.27rc3

Change-Id: I400bf6802223b50d5b0273153984e801a66bc317
Reviewed-on: https://go-review.googlesource.com/c/go/+/814825
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Mark Freeman <mark@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit b0365c1777662ae45534c0e728a12a8b19874759 [browse]
Author: Neal Patel
Date: 2026-08-07 00:23:22 Z

[release-branch.go1.27] cmd/vendor: fix CVE-2026-56865 in x/mod

Fixes #80744
Fixes CVE-2026-56865

Change-Id: I1e063053041c2d88b7801bfe09b6060f4def6afe
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5140
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5180
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814862
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit a3876703796b5d3db7a7c6f2193e8663399f2339 [browse]
Author: Neal Patel
Date: 2026-08-07 00:25:05 Z

[release-branch.go1.27] cmd/vendor: fix CVE-2026-56864 in x/mod

Fixes #80745
Fixes CVE-2026-56864

Change-Id: Ia60dafca958d02a7ee0ec45d49e1db001c79d981
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5121
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5221
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814861
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <mark@golang.org>

commit 41cb2f352e2b4cfb93809ede794d7e5ee9ec2c68 [browse]
Author: Ian Alexander
Date: 2026-06-08 12:56:36 -04:00

[release-branch.go1.27] encoding/asn1: enforce maximum recursion depth

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.

Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this
issue.

Fixes CVE-2026-33818
Fixes #80405

Change-Id: Ic78d104432f8665a2949b95935fea23b5e35cff7
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4780
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5202
Reviewed-on: https://go-review.googlesource.com/c/go/+/814860
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <mark@golang.org>

commit bcdba48a6adcaceabb3696e46b50be21dc739b5e [browse]
Author: Neal Patel
Date: 2026-07-28 17:06:12 -04:00

[release-branch.go1.27] html/template: fix JavaScript regexp tracking

This change prevents pathological inputs from
closing an unescaped `/` early, allowing for
attacker-controlled data to inject arbitrary
unscaped content.

Additionally, CL 532595 hints at the invariant
in TestEscapeText potentially getting the update
this change makes.

For #80435
Fixes CVE-2026-56858

Change-Id: I502b8960249fa9a2827b44b64d081d224ac57cbc
Reviewed-on: https://go-review.googlesource.com/c/go/+/807100
Reviewed-by: Neal Patel <nealpatel@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 0157ee9c8d501bac60d2ec8689fac1eea740215a)
Reviewed-on: https://go-review.googlesource.com/c/go/+/811040