Go x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfault#golang
Go x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultGo patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultGo x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultGo 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultGo 1.26.6 and 1.25.13 security releases due August 11
The Go team will ship private standard library and toolchain fixes for three CVEs.
By segfault