What were the notable Go updates?

mime: avoid quadratic complexity in WordDecoder.DecodeHeader, _content/doc/security: add FIPS 140-3 Go Cryptographic Module changelog, and _content/doc/security: document the inprocess and certified aliases.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

MIME DECODER QUADRATIC COMPLEXITY PATCHED; FIPS 140-3 DOCS FINALIZED

By RepoJournal · Filed 06:01 UTC on May 7, 2026 · About Go

Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem.

The mime.WordDecoder.DecodeHeader fix [1] addresses CVE-2026-42504 by skipping entire undecodable encoded-words instead of byte-by-byte processing — a change that eliminates quadratic complexity attacks on email headers and similar MIME-encoded payloads. Simultaneously, the Go website finalized FIPS 140-3 guidance [2][3][4][5][6], shifting users from the legacy GODEBUG=fips140 flag toward the new GOFIPS140 environment variable and the crypto/fips140.Version API, with explicit warnings against the restrictive fips140=only mode. On the runtime front, goroutineleakprofile is now always-on by default [7] — there's no longer an experiment toggle to disable it, simplifying the profiling surface. The deprecation checker in cmd/api [8][9] fixed false positives and negatives by enforcing the spec: deprecated markers must start a paragraph, not hide mid-sentence. Go's build toolchain addressed a deadlock condition in cmd/go [10], while gopls expanded its linter arsenal with an errorsastype analyzer [11] to catch incorrect errors.As patterns. Over on pkg.go.dev, the API layer refactored package endpoints [12][13][14] to reduce payload redundancy and generalize pagination testing — changes that improve developer experience without breaking existing integrations.

Action items

→ Review and patch systems handling MIME-encoded email headers or HTTP payloads — this DoS fix is critical for production services golang/go [immediate]
→ Audit FIPS 140-3 deployments and migrate from GODEBUG=fips140 to GOFIPS140 environment variable golang/website [plan]
→ Update gopls and enable errorsastype linter in your CI pipeline for stricter error handling checks golang/tools [plan]
→ Monitor pkg.go.dev API pagination behavior after the refactor — no action needed unless you parse the raw API golang/pkgsite [monitor]

References

[1] mime: avoid quadratic complexity in WordDecoder.DecodeHeader golang/go
[2] _content/doc/security: add FIPS 140-3 Go Cryptographic Module changelog golang/website
[3] _content/doc/security: document the inprocess and certified aliases golang/website
[4] _content/doc/security: document crypto/fips140.Version golang/website
[5] _content/doc/security: deemphasize GODEBUG=fips140 in favor of GOFIPS140 golang/website
[6] _content/doc/security: discourage use of GODEBUG=fips140=only golang/website
[7] internal/goexperiment,runtime: drop goroutineleakprofile experiment golang/go
[8] cmd/api: fix false positive and false negative in isDeprecated golang/go
[9] cmd/api/testdata: add test case for issue 79145 golang/go
[10] cmd/go: fix potention deadlock golang/go
[11] gopls: add errorsastype analyzer golang/tools
[12] internal/api: add fields to PackageInfo golang/pkgsite
[13] internal/tests/api: generalize pagination tests golang/pkgsite
[14] internal/api: factor out common packages fields golang/pkgsite

Quick answers

What shipped in Go on May 7, 2026?: Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem. In total, 30 commits landed.
What were the notable Go updates?: mime: avoid quadratic complexity in WordDecoder.DecodeHeader, _content/doc/security: add FIPS 140-3 Go Cryptographic Module changelog, and _content/doc/security: document the inprocess and certified aliases.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.