What were the notable Go updates?

ssh: prevent malformed exit-status panic, debug/dwarf: report underflow error on failure to read a varint, and cmd/compile: ensure evaluating array index expression.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

SSH MALICIOUS SERVER CRASH, CORRUPT DATA MEMORY BOMBS PLUGGED ACROSS STDLIB

By RepoJournal · Filed 06:01 UTC on May 26, 2026 · About Go

A single malformed packet from an SSH server crashes any Go client outright, while three separate stdlib bugs silently consume unbounded memory on corrupt input.

The SSH vulnerability [1] is the immediate threat: an attacker controlling the remote server can send a truncated exit-status payload that panics binary.BigEndian.Uint32, dropping your connection mid-flight with zero warning. This patches today.

Three memory bombs landed in quick succession across debug/dwarf, encoding/gob, and crypto internals. The debug/dwarf fix [2] stops endless loops when parsing corrupt DWARF data from invalid binaries, while encoding/gob now caps map allocation [5] to prevent adversarial input from consuming all available heap. Both rely on fuzzer findings rather than test cases, so expect more surface area to harden as real-world crashes bubble up.

On the compiler side, a critical bounds-check regression slipped into 1.24 [3]. The fix for zero-sized arrays was incomplete and missed nested types, meaning some index operations never got safety checks inserted. This one is subtle enough that it might ship in production before anyone notices.

Two smaller fixes round out the batch: cmd/go now properly returns non-zero exit status when tools are interrupted by signals [4] instead of pretending they succeeded, and the GC memory limit test on Darwin got loosened again because apparently the last two attempts weren't quite enough.

Action items

→ Patch golang/crypto immediately if you use ssh package golang/crypto [immediate]
→ Upgrade to latest Go patch release before next deploy golang/go [plan]
→ Monitor for DWARF/gob crashes in production fuzzing pipelines golang/go [monitor]

References

[1] ssh: prevent malformed exit-status panic golang/crypto
[2] debug/dwarf: report underflow error on failure to read a varint golang/go
[3] cmd/compile: ensure evaluating array index expression golang/go
[4] cmd/go: return non-zero when go tool is interrupted golang/go
[5] encoding/gob: cap map size when decoding golang/go

Quick answers

What shipped in Go on May 26, 2026?: A single malformed packet from an SSH server crashes any Go client outright, while three separate stdlib bugs silently consume unbounded memory on corrupt input. In total, 8 commits landed.
What were the notable Go updates?: ssh: prevent malformed exit-status panic, debug/dwarf: report underflow error on failure to read a varint, and cmd/compile: ensure evaluating array index expression.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.