$ the-wire · showcase
Go's HTTP stack gets a hardening wave, x/crypto fixes a LoongArch keystream bug
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
A cluster of adversarial-input fixes landed across Go's HTTP/1, HTTP/2, and MIME paths, while golang/crypto repaired a LoongArch Salsa20 tail that reused keystream bytes.
net/http: apply header limits to Trailer headers too golang/go
The server now applies header limits to Trailer headers, which were previously exempt because request trailers are copied into the Request.Trailer map one entry at a time. An HTTP/2 client could declare a huge number of trailer fields and force allocation past Server.MaxHeaderBytes. Note the tracker: net/http carries CVE-2026-78659 for this in the standard library.
http2: avoid 2x refund on stream close with buffered data golang/net
A stream that is reset and then read by the handler refunded flow control twice, letting a malicious client push the server past its connection window and buffer far more data than the limits allow. Cited in the commit as the report from Ali Sherif.
net/http, net/http/httputil: avoid post-CONNECT pool corruption golang/go
When a CONNECT request is rejected, the Request.Body is not data to discard: it becomes the start of a new request on that connection. The transport was returning the connection to the pool anyway; it no longer does, so a payload can't be reinterpreted as a second request.
salsa20: fix keystream reuse in LoongArch LSX tail golang/crypto
The LoongArch LSX tail path for lengths under 256 bytes consumed keystream vectors V0-V15 that the preceding 256-byte iteration had already spent. For a 257-byte input, byte 256 was XORed with the same keystream word as byte 0, which is keystream reuse; the tail now jumps back to loop256 for a fresh four-block keystream.
net/http/internal/http2: avoid excessive work on initial window changes golang/go
A peer can send repeated SETTINGS adjustments to the initial flow control window, and each one previously triggered work proportional to the stream count. Decreases can legitimately drive a stream window negative, so the fix targets the cost of applying them rather than the arithmetic.
go/gcexportdata: remove bundle functionality golang/tools
gcexportdata's experimental bundle functions are now deprecated and return an error rather than doing anything; nothing in x/tools or the wider module graph still depends on them, but a couple of external projects adopted them after the proposal was approved and have open issues about the removal.
Action items
