SB2026073126 - Multiple vulnerabilities in Go programming language

Description

This security bulletin contains information about 10 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2026-39820)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in net/mail address and date parsing functions when parsing well-crafted input. A remote attacker can send specially crafted input to cause a denial of service.

2) Input validation error (CVE-ID: CVE-2026-42501)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to bypass checksum database validation.

The vulnerability exists due to improper input validation in cmd/go when validating downloaded modules and toolchain downloads through a module proxy or checksum database. A remote attacker can return an empty checksum response or a checksum response for an unrelated module to bypass checksum database validation.

Exploitation requires use of an untrusted module proxy or checksum database, and downloaded toolchains are affected when a different Go toolchain version is selected.

3) Cross-site scripting (CVE-ID: CVE-2026-39823)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform cross-site scripting.

The vulnerability exists due to improper neutralization of input during web page generation in html/template meta content attribute escaping when rendering a template containing a URL in a tag's content attribute. A remote attacker can supply a specially crafted URL containing ASCII whitespace around the '=' character to perform cross-site scripting.

4) Double free (CVE-ID: CVE-2026-33811)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to double free in net.LookupCNAME and Resolver.LookupCNAME when processing a very long CNAME response with the cgo DNS resolver. A remote attacker can send a specially crafted DNS response to cause a denial of service.

5) Cross-site scripting (CVE-ID: CVE-2026-39826)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary script content in a browser.

The vulnerability exists due to improper output neutralization in html/template when rendering a