MGASA-2026-0497: golang Mageia
Vulnerability summary
MGASA-2026-0497 is a vulnerability in golang Mageia with no CVSS score yet.
Advisory lineage
Upstream 14 · Downstream 0Timeline
- 13-10-2026PublishedVulnerability first disclosed.
- 13-10-2026Last modifiedVulnerability information updated.
Description
Updated golang packages fix security vulnerabilities net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain html/template: reset context tracking on consecutive template expressions html/template: recognize |yield| as regexp preceder keyword net/textproto, mime/multipart: memory limit bypass when parsing MIME headers net/http: HTTP/1 client connection desynchronization after CONNECT rejection net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response net/http: excessive CPU consumption from repeated initial window changes net/http: HTTP/2 transport accepts malformed framing-related headers net/http: lack of limit on size of parsed Range headers net/http: double flow control refund on HTTP/2 server streams
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia1 product
- golang< 1.26.9-1.mga10
1 vendor · 1 product