Go Security Update: Fixes for CVE-2024-42504, CVE-2024-42507, CVE-2025-27145 (DoS/Info Disclosure)

Vulnerability Overview Three security fixes have been released in Go 1.26.4 and Go 1.25.11, addressing the following vulnerabilities: 1. mime: Quadratic complexity in WordDecoder.DecodeHeader - Decoding malicious MIME headers containing many invalid encoded words can lead to excessive CPU consumption. - Fix: The MIME decoder now handles this case more effectively. 2. net/http: Arbitrary input included in errors without escaping - When returning errors, functions in the package return input as part of the error message without escaping. - This may allow attackers to inject misleading content, terminal control bytes, etc., affecting the output received by the victim. - Fix: The client now properly handles this case when parsing headers received from the server using . 3. crypto/x509: Split candidate hostnames only once - The x509 certificate validator previously called , which iterated over all DNS Subject Alternative Name (SAN) entries. - This resulted in repeated calls on the same input hostnames. - Fix: The x509 validator now validates hostnames before constructing the certificate chain, thereby reducing overhead for unverified certificates. Impact Scope mime: Quadratic complexity in WordDecoder.DecodeHeader - Impact: Decoding malicious MIME headers may lead to excessive CPU consumption. net/http: Arbitrary input included in errors without escaping - Impact: Attackers can inject misleading content, terminal control bytes, etc., affecting the output received by the victim. crypto/x509: Split candidate hostnames only once - Impact: Increased overhead for unverified certificates. Remediation mime: Quadratic complexity in WordDecoder.DecodeHeader - Fix: The MIME decoder now handles this case more effectively. net/http: Arbitrary input included in errors without escaping - Fix: The client now properly handles this case when parsing headers received from the server using . crypto/x509: Split candidate hostnames only once - Fix: The x509 validator now validates hostnames before constructing the certificate chain, thereby reducing overhead for unverified certificates. Related Links CVE-2024-42504: https://go.dev/issue/70217 CVE-2024-42507: https://go.dev/issue/79346 CVE-2025-27145: https://go.dev/issue/79694 More Information Release Notes Download binaries and source distributions

Goal Reached Thanks to every supporter — we hit 100%!

Go Security Update: Fixes for CVE-2024-42504, CVE-2024-42507, CVE-2025-27145 (DoS/Info Disclosure)