USN-8935-1: golang-1.22 Ubuntu

Vulnerability summary

USN-8935-1 is a vulnerability in golang-1.22 Ubuntu with no CVSS score yet.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

golang-1.22 vulnerabilities It was discovered that Go did not enforce a maximum recursion depth when parsing deeply nested ASN.1 structures. An attacker could possibly use this issue to cause Go to crash, resulting in a denial of service. (CVE-2026-33818) It was discovered that Go incorrectly reset the depth counter when decoding XML elements. An attacker could possibly use this issue to cause Go to crash via deeply nested XML input, resulting in a denial of service. (CVE-2026-56859) It was discovered that Go incorrectly handled TLS KeyUpdate messages after the handshake was completed. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-56862) It was discovered that Go did not correctly verify checksum database tiles against their parents. An attacker in control of a malicious module proxy could possibly use this issue to bypass checksum database verification and serve malicious module content. (CVE-2026-56865) It was discovered that the Go HTTP client incorrectly returned connections to the idle pool after a rejected HTTP/1 CONNECT request with a request body. A remote attacker could possibly use this issue to perform HTTP response poisoning attacks against reverse proxies. (CVE-2026-56866) It was discovered that the Go HTTP/2 server did not apply header limits to Trailer headers. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78659) It was discovered that the Go HTTP/2 implementation did not remove malformed framing-related headers when forwarding responses. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks when Go was acting as a reverse proxy. (CVE-2026-78660) It was discovered that the Go HTTP/2 server could refund connection-level flow control twice for the same data under certain circumstances. A remote attacker could possibly use this issue to bypass the configured connection-level flow control limit. (CVE-2026-78663) It was discovered that Go did not limit the size of Range headers parsed when serving content over HTTP. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78667) It was discovered that the Go HTTP/2 implementation incorrectly handled SETTINGS frames that changed the initial window size. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-78669) It was discovered that the Go HTTP server continued to serve requests on a connection after sending a successful response to an HTTP/1 CONNECT request. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-94439) It was discovered that Go did not enforce memory limits on the first line of a part when parsing multipart forms. A remote attacker could possibly use this issue to cause Go to use excessive resources, leading to a denial of service. (CVE-2026-94440)

No weakness data has been published for this record.