Go: Security Fixes Across Crypto Stack
Several fixes landed today addressing overflow and denial-of-service risks in Go's cryptography libraries, alongside a compiler correctness fix for the prove pass. Developers using crypto/x509, crypto/tls, or crypto/ecdsa should note these behavior changes.
Duration: PT2M36S
Episode overview
This episode is a short developer briefing from Go.
It explains recent repository work in plain language.
- Show: Go
- Published: 2026-07-29T13:06:09Z
- Audio duration: PT2M36S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's July 29th, 2026, and this is Go.
Today's activity centers on one clear theme: hardening the crypto stack against edge cases that could be exploited or cause crashes.
Start with pull request 80600. It fixes an integer overflow in x509's OID parsing, where combining the first two arcs of an object identifier could silently wrap and produce the wrong OID instead of erroring. That's now rejected at the boundary.
Next, a commit from Nicholas Husin closes out a more serious issue in crypto/tls, tracked as CVE-2026-56862. Before this fix, a malicious client could send repeated KeyUpdate messages after a handshake completed and force the server into endless key derivation work — a denial-of-service vector. The fix makes…
Rounding out the crypto theme, Filippo Valsorda fixed a panic in crypto/ecdsa when Sign is called with an empty hash value, and pull request 80611 corrected a documentation typo affecting how developers disable the SecP384r1MLKEM1024 curve via GODEBUG — small, but the kind of doc bug that leads to real…
On the compiler side, Jorropo landed a significant fix to the prove pass, addressing what he called "time traveling proofs" — cases where the optimizer…
Nearby episodes from Go
- Compiler Squeezes Out More Speed at the Instruction Level
- Squeezing Cycles Out of the AMD64 Compiler
- Weekly Recap - Security Hardening and Compiler Correctness
- Fixing a Silent Data Corruption Bug in MIPS Register Allocation
- Cleaning Up the Small Stuff
- Correctness Fixes Across Testing, Runtime, and Security
- Compiler Correctness Sweep
- Shaving Cycles Everywhere