Go: Security Fixes and Parser Performance
Two CVE fixes landed for encoding XML and net URL parsing, while a cluster of archive tar and net HTTP changes tightened error handling and header parsing performance.
Duration: PT2M48S
Episode overview
This episode is a short developer briefing from Go.
It explains recent repository work in plain language.
- Show: Go
- Published: 2026-07-30T13:06:25Z
- Audio duration: PT2M48S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Go, your daily developer briefing for July 30th, 2026.
The top story today is security. Two commits close out CVEs in widely used standard library packages, and both point to the same lesson: recursive and iterative parsing code needs careful state tracking.
In encoding XML, commit ccb0514 fixes a bug where the decoder's recursion depth guard could be bypassed entirely. The issue was that decode element passed a constant instead of tracking real depth, and custom unmarshal methods with their own loops could sidestep the guard altogether. The fix replaces dual depth…
In net URL, commit 594b58a fixes a quadratic complexity problem in path resolution. The old code built strings incrementally per iteration; the fix operates on a byte slice with index-based backtracking. Benchmarks show the worst case, backtracking paths, dropped over 64 percent in time and 97 percent in…
A second theme is careful error and byte handling in lower-level packages. PR 80624 fixes an HTTP/2 issue where a stream error from a nested transport's reader could be mistaken for a sticky connection error, causing a read loop to spin. The fix wraps reader-originated errors so they're distinguishable from…
A…
Nearby episodes from Go
- Security Fixes Across Crypto Stack
- Compiler Squeezes Out More Speed at the Instruction Level
- Squeezing Cycles Out of the AMD64 Compiler
- Weekly Recap - Security Hardening and Compiler Correctness
- Fixing a Silent Data Corruption Bug in MIPS Register Allocation
- Cleaning Up the Small Stuff
- Correctness Fixes Across Testing, Runtime, and Security
- Compiler Correctness Sweep