Go: Certificate Parsing Gets Stricter, TLS Memory Gets Leaner
The Go project shipped a security fix for X.509 URI name constraint matching, tightened certificate parsing to reject malformed constraint sequences, and cut per-connection memory in crypto/tls by pooling buffers instead of pinning them during idle reads.
Duration: PT2M30S
Episode overview
This episode is a short developer briefing from Go.
It explains recent repository work in plain language.
- Show: Go
- Published: 2026-09-05T13:07:29Z
- Audio duration: PT2M30S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 5th, and this is Go.
Today's activity centers on certificate validation and connection memory, with a security fix at the core.
Start with crypto x509. Daniel McCarney's commit 74cad37 fixes CVE-2026-78665: Go was using DNS-style subtree matching for URI name constraints, which meant a constraint on "example dot com" could wrongly match subdomains. That's now corrected to exact-host matching per the spec, and a related quirk—treating…
Second theme: connection memory in crypto slash tls. Brad Fitzpatrick's commit 0d18363 addresses long-idle TLS connections pinning oversized buffers—up to seventeen kilobytes—for the life of a blocked read. The fix pools those buffers, dropping per-connection heap use by roughly five times in testing, with no…
Elsewhere, SVE SIMD support continues to fill in—Junyang Shao added multiply and multiply-high operations and broadened test coverage across element shapes, David Chase added a cross-platform reduce-sum operation. These are incremental capability additions tracked under issue 79781, not yet urgent for most users.…
What's next: if you parse or validate X.509 certificates, expect stricter rejection of malformed…
Nearby episodes from Go
- Plugin Bug Fix and Protocol Correctness
- SVE Expands, Compiler Correctness Cleanup
- Compiler Analysis Gets Sharper, Runtime Gets Less Blocking
- Compiler Efficiency and HTTP Cleanup
- Aliasing Bugs and Correctness Cleanup in Math Big
- Weekly Recap - Correctness Fixes Across the Stack
- Guarding Against Bad Input, One Panic at a Time
- Correctness Cleanup Across the Stack