Go releases fix build time code execution and HTTP flaws

Go 1.27.4 and 1.26.11 have been released on 10 November 2026 to fix 12 security flaws, eleven of which target the Go toolchain and specifically mitigate build-time code execution via cgo. A malicious Go package could abuse cgo directives, linker flags or crafted object files to run code during a build, potentially exposing build secrets and signing keys. The twelfth issue patches a crash in HTTP/1 servers. The Go security team says these fixes apply to Linux, macOS and Windows builds, since several bugs target each platform’s linker.

The release notes identify CVEs tied to the flaws: CVE-2026-97033 through CVE-2026-97040 (and related entries), with CVE-2026-97054 affecting net/http. Evidence and disclosure indicate that most bugs were found during an internal audit by the Go Security Team, with additional reporting from external researchers Jakub Ciolek, Ali Sherif and RyotaK of GMO Flatt Security. There are no reports of exploitation in the wild, and CVSS scores are not yet published.

Affected versions are Go versions before 1.26.11 and Go 1.27.0 through 1.27.3; the recommended remedy is to upgrade to Go 1.27.4 or 1.26.11 and rebuild binaries, including updating CI images and build containers. Where possible, developers are advised to disable CGO-enabled builds (CGO_ENABLED=0) and review new dependencies that ship .syso files or rely on cgo.