Posted by Alan Coopersmith on Nov 05 Forwarded Message Subject: [security] Go 1.27.4 and Go 1.26.11 pre-announcement Date: Thu, 5 Nov 2026 22:10:14 +0000 From: announce () golang org To: golang-nuts () googlegroups com Hello gophers, We plan to issue Go 1.27.4 and Go 1.26.11 during US business hours on Tuesday, November 10. These minor releases include PRIVATE security fixes to the standard library and the toolchain, covering the following CVEs:...
Fwd: Go 1.27.4 and Go 1.26.11 pre-announcement
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/532
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Vincent Lefevre on Nov 05 Perhaps, but in any case, it is up to the application to check error conditions, in particular that the result contains only valid…
Re: CPython sandbox escape
Posted by Sam James on Nov 05 Alan Coopersmith writes: https://lwn.net/Articles/574215/ sam
zlib 1.4 released with security fixes
Posted by Alan Coopersmith on Nov 05 https://github.com/madler/zlib/releases/tag/v1.4 lists these security fixes:
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Loganaden Velvindron on Nov 05 It's unfortunate that some people are writing misleading statements about a security problem in OpenSSH, especially on linkedin…
CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Inconsistent interpretation of HTTP requests ('HTTP…
CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Improper output neutralization for logs in Apache Sling…