From f204a673370e69e2de13e577f36ec4a52589e8e5 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Thu, 7 May 2026 21:50:46 +0200 Subject: [PATCH] package/go-bootstrap-stage5: security bump to version 1.25.10 Fixes the following security issues: CVE-2026-33811: net: crash when handling long CNAME response CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary filenames CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment CVE-2026-39823: html/template: bypass of meta content URL escaping causes XSS CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters CVE-2026-39826: html/template: escaper bypass leads to XSS CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on Windows CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database go1.25.10 (released 2026-05-07) includes security fixes to the go command, the pack tool, and the html/template, net, net/http, net/http/httputil, net/mail, and syscall packages, as well as bug fixes to the go command, the compiler, the linker, the runtime, and the crypto/fips140, go/types, and os packages. https://go.dev/doc/devel/release#go1.25.10 Signed-off-by: Peter Korsgaard Reviewed-by: Christian Stewart Signed-off-by: Julien Olivain (cherry picked from commit c19e6d80fbcff18465a6839676195a91db18ace5) Signed-off-by: Thomas Perale --- package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash | 2 +- package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash index 5e40ba7e6e..58391471d9 100644 --- a/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash +++ b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash @@ -1,3 +1,3 @@ # From https://go.dev/dl -sha256 e988d4a2446ac7fe3f6daa089a58e9936a52a381355adec1c8983230a8d6c59e go1.25.8.src.tar.gz +sha256 20cf04a92e5af99748e341bc8996fa28090c9ac98765fa115ec5ddf41d7af41d go1.25.10.src.tar.gz sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE diff --git a/package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk index 9006e5bf44..85468414a2 100644 --- a/package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk +++ b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk @@ -6,7 +6,7 @@ # Use last Go version that go-bootstrap-stage4 can build: v1.25.x # See https://go.dev/doc/go1.26#bootstrap -GO_BOOTSTRAP_STAGE5_VERSION = 1.25.8 +GO_BOOTSTRAP_STAGE5_VERSION = 1.25.10 GO_BOOTSTRAP_STAGE5_SITE = https://go.dev/dl GO_BOOTSTRAP_STAGE5_SOURCE = go$(GO_BOOTSTRAP_STAGE5_VERSION).src.tar.gz