From a4ec1dcd890b2a77a98cedf5bcc1010d44b343b4 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 8 Jun 2026 12:24:20 +0200 Subject: [PATCH] update to go1.26.4 This release include 3 security fixes following the security policy: - mime: quadratic complexity in WordDecoder.DecodeHeader Decoding a maliciously-crafted MIME header containing many invalid encoded-words could consume excessive CPU. The MIME decoder now better handles this case. Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue. This is CVE-2026-42504 and Go issue https://go.dev/issue/79217. - net/textproto: arbitrary input are included in errors without any escaping When returning errors, functions in the net/textproto package would include its input as part of the error, without any escaping. Note that said input is often controlled by external parties when using this package naturally. For example, a net/http client uses ReadMIMEHeader when parsing the headers it receive from a server. As a result, an attacker could inject arbitrary content into the error. Practically, this can result in an attacker injecting misleading content, terminal control bytes, etc. into a victim's output or logs. This is CVE-2026-42507 and Go issue https://go.dev/issue/79346 - crypto/x509: split candidate hostname only once (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue. This is CVE-2026-27145 and https://go.dev/issue/79694. View the release notes for more information: https://go.dev/doc/devel/release#go1.26.4 Signed-off-by: Sebastiaan van Stijn --- .go-version | 2 +- Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.go-version b/.go-version index f8f738140..ea0928ced 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.26.3 +1.26.4 diff --git a/Dockerfile b/Dockerfile index ece30ffd7..4be123603 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG GO_VERSION=1.26.3 +ARG GO_VERSION=1.26.4 ARG XX_VERSION=1.9.0 ARG GOLANGCI_LINT_VERSION=v2.11.3 ARG ADDLICENSE_VERSION=v1.0.0