VULNpocalypse
HighVulnerabilityPatch available

Go 1.27.2 and 1.27.3: 15 security fixes including HTTP/2 server crashes, then a crypto/x509 distrust of the eMudhra intermediates

Two Go point releases fix HTTP/2 crash and exhaustion bugs, a toolchain checksum bypass and the eMudhra CA keys. Rebuild with Go 1.27.3 or 1.26.10.

Published
Updated
Fixed in
Go 1.27.3 and 1.26.10 (include the 1.27.2 and 1.26.9 fixes); golang.org/x/net 0.60.0 for direct x/net/http2 users
Exploitation
No exploitation reported; none of the CVEs is in CISA KEV as of 30 October 2026

Live scores

CVE-2026-97032
EPSS
0.005
low predicted chance of attack
VEDAS
0.055
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-78659
EPSS
0.006
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-78669
EPSS
0.006
low predicted chance of attack
VEDAS
0.047
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-78667
EPSS
0.005
low predicted chance of attack
VEDAS
0.051
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-97031
EPSS
0.005
low predicted chance of attack
VEDAS
0.521
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-94447
EPSS
0.001
low predicted chance of attack
VEDAS
0.055
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-97030
EPSS
0.003
low predicted chance of attack
VEDAS
0.056
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-111943
EPSS
0.004
low predicted chance of attack
VEDAS
0.916
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

Go shipped two rounds of security fixes in October 2026.

Go 1.27.2 and 1.26.9 (8 October) fixed 15 security issues in the go command and the crypto/tls, html/template, net/http, net/textproto and os packages (Go release history; golang-announce). The ones most likely to matter on servers:

  • CVE-2026-97032, HTTP/2 server crash. The server changes its HPACK encoder from two goroutines without locking. A client that keeps sending requests while changing the header table size can crash the server (CVE record).
  • CVE-2026-78659, HTTP/2 memory exhaustion. A client can declare a huge number of fields in a Trailer header and make the server allocate memory past the MaxHeaderBytes limit. HTTP/1 servers are not affected (CVE record).
  • CVE-2026-78669, HTTP/2 CPU exhaustion. A peer opens many streams, then sends many small SETTINGS frames that change the initial window size. It affects clients and servers (CVE record).
  • CVE-2026-78667, Range header CPU exhaustion in FileServer, ServeContent and ServeFile (CVE record).
  • CVE-2026-97031, ECH memory exhaustion in crypto/tls servers, from malformed outer extension references (CVE record).
  • CVE-2026-94447, toolchain checksum bypass. Inside a malicious project that defines a bogus golang.org/toolchain entry in go.sum, and with a malicious module proxy, cmd/go could skip the checksum check on a downloaded toolchain. Go now always fetches the canonical checksum from the network (CVE record). A related fix covers golang.org/fips140 (CVE-2026-94444).
  • CVE-2026-97030, html/template escaping of the yield keyword (CVE record).

The release also fixes two HTTP/1 connection desynchronization bugs around CONNECT (CVE-2026-56866, CVE-2026-94439), a MIME header memory limit bypass (CVE-2026-94440), and os.Root following junctions out of the root on Windows (CVE-2026-56857), among others (golang-announce).

Go 1.27.3 and 1.26.10 (19 October) fixed crypto/x509 only (Go release history). Go added a denylist so Verify rejects chains through “a small set of intermediate certificates” (golang-announce). The Go announcement does not name the CA. Tailscale’s bulletin says this release “explicitly distrusts” the compromised eMudhra intermediates (Tailscale TS-2026-013). It is tracked as CVE-2026-111943. The record explains that Go normally uses the system roots, but system stores may not be updated in some cases, so the denylist covers them (CVE record). See our eMudhra advisory for that incident.

None of these CVEs is in CISA’s KEV catalog as of 30 October 2026, and the CVE records show no known exploitation.

Am I affected?

Any Go binary built with a toolchain older than 1.26.9 or 1.27.2 has the HTTP/2 and toolchain bugs. Anything older than 1.26.10 or 1.27.3 lacks the eMudhra distrust.

bash
# The toolchain on this machine
go version

# Which toolchain built a binary, and its module versions (including x/net)
go version -m ./mybinary | head -20

# Reachability check against the Go vulnerability database
govulncheck ./...

Check where the Go version is pinned: the go and toolchain lines in go.mod, the FROM golang: line in Dockerfiles, and go-version in CI setup steps. A pin like golang:1.27 picks up a new patch release only when the image is pulled again.

If you import golang.org/x/net/http2 directly, its version is separate from the toolchain:

bash
go list -m golang.org/x/net    # want v0.60.0 or later

What to do now

  1. Bump the toolchain to 1.27.3 or 1.26.10 in go.mod (toolchain line), Dockerfiles and CI, then rebuild and redeploy every binary and image. Third-party Go tools you run (CLIs, agents, sidecars) need their vendors to rebuild; check their release notes for Go 1.27.3 or 1.26.10.
  2. Update golang.org/x/net to 0.60.0 if your code or dependencies use x/net/http2 directly: go get golang.org/x/net@v0.60.0 && go mod tidy.
  3. Prioritise internet-facing HTTP/2 servers. CVE-2026-97032 crashes the process and CVE-2026-78659 and CVE-2026-78669 exhaust memory and CPU. If you cannot rebuild yet, terminating HTTP/2 at a proxy that is not written in Go limits exposure.
  4. Do not use untrusted module proxies when building untrusted code. CVE-2026-94447 needed both a malicious project and a malicious GOPROXY. Keep GOPROXY and GOSUMDB at trusted values in CI.
  5. After rebuilding, test TLS clients against servers you depend on. A server whose chain runs through one of the denied eMudhra intermediates will now fail verification; fix the server’s certificate, not the client.

Sources