RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-26
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SSH MALICIOUS SERVER CRASH, CORRUPT DATA MEMORY BOMBS PLUGGED ACROSS STDLIB

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

A single malformed packet from an SSH server crashes any Go client outright, while three separate stdlib bugs silently consume unbounded memory on corrupt input.

The SSH vulnerability [1] is the immediate threat: an attacker controlling the remote server can send a truncated exit-status payload that panics binary.BigEndian.Uint32, dropping your connection mid-flight with zero warning. This patches today.

Three memory bombs landed in quick succession across debug/dwarf, encoding/gob, and crypto internals. The debug/dwarf fix [2] stops endless loops when parsing corrupt DWARF data from invalid binaries, while encoding/gob now caps map allocation [5] to prevent adversarial input from consuming all available heap. Both rely on fuzzer findings rather than test cases, so expect more surface area to harden as real-world crashes bubble up.

On the compiler side, a critical bounds-check regression slipped into 1.24 [3]. The fix for zero-sized arrays was incomplete and missed nested types, meaning some index operations never got safety checks inserted. This one is subtle enough that it might ship in production before anyone notices.

Two smaller fixes round out the batch: cmd/go now properly returns non-zero exit status when tools are interrupted by signals [4] instead of pretending they succeeded, and the GC memory limit test on Darwin got loosened again because apparently the last two attempts weren't quite enough.

Action items

References

  1. [1] ssh: prevent malformed exit-status panic ↗ golang/crypto
  2. [2] debug/dwarf: report underflow error on failure to read a varint golang/go ↗
  3. [3] cmd/compile: ensure evaluating array index expression ↗ golang/go
  4. [4] cmd/go: return non-zero when go tool is interrupted ↗ golang/go
  5. [5] encoding/gob: cap map size when decoding golang/go ↗

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 26, 2026?
A single malformed packet from an SSH server crashes any Go client outright, while three separate stdlib bugs silently consume unbounded memory on corrupt input. In total, 8 commits landed.
What were the notable Go updates?
ssh: prevent malformed exit-status panic, debug/dwarf: report underflow error on failure to read a varint, and cmd/compile: ensure evaluating array index expression.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.