CVS commit: pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Tue Nov 10 18:36:58 UTC 2026

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go126: PLIST distinfo
        pkgsrc/lang/go127: PLIST distinfo

Log Message:
go: update to 1.27.4 and 1.26.11 (security)

These releases include 12 security fixes following the security policy <https://go.dev/doc/security/policy>:

- net/http: HTTP/1 server crash due to MaxBytesReader header race

  For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
  "Connection: close" header is automatically set without synchronization,
  which might race with another header being set explicitly in the server
  handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
  MaxBytesHandler can crash due to runtime panic if its handler reads the
  request body concurrently with writing the response header.

  Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.

  This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.

- cmd/go: unexpected code execution via --sysroot, -target, -isysroot,
  -Wl,-syslibroot, and -x cgo flags

  Building a malicious package that uses cgo could cause arbitrary code
  execution at build time through several compiler and linker flags
  permitted in "#cgo" directives.

  Specifically, "--sysroot" in GCC and Clang relocates compiler
  subprograms, spec files, and CRT startup objects to an
  attacker-controlled directory; "-target" in Clang falls back to
  executing target helper tools from the current working directory when
  not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a
  regular file on disk to GNU ld.bfd, which interprets it as a
  positional linker script; and "-x" permitted specifying arbitrary
  compiler input languages beyond those supported by cgo.

  "--sysroot" and "-target" are now disallowed in "#cgo" flags,
  "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular
  files, and "-x" is restricted to the C, C++, Objective-C, and
  assembler languages supported by cgo.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97033 and Go issue https://go.dev/issue/82577.

-  cmd/go: arbitrary command execution via GCC spec files in cgo linker
   search directories

  When using GCC, building a malicious package that uses cgo could cause
  arbitrary command execution at link time via untrusted GCC spec files
  ("specs" or "*.spec").

  When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo
  LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)"
  or "%:include(libsanitizer.spec)" and searches for spec files in "-L"
  and sysroot directories (including subdirectories and multilib sibling
  directories such as "../lib64"), as well as the working directory when
  "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined
  with "-static" or "-static-lib*".

  The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot"
  directories (and the working and package directories when applicable)
  that contain GCC spec files, and disallows "@" and "-" prefixes in
  "-fsanitize=" compiler flag values.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97034 and Go issue https://go.dev/issue/82576.

- cmd/go: unexpected code execution and arbitrary file write via Clang
  -gen-* and GCC -gnat* flags in cgo

  When using Clang or GCC, building a malicious package that uses cgo
  could cause unexpected code execution at build time or write files to
  arbitrary directories via "-gen-" or "-gnat" flags in "#cgo"
  directives.

  The "-g*" wildcard in the compiler and linker flag allowlists
  previously matched Clang's two-argument "-gen-cdb-fragment-path " flag
  and GCC's two-argument "-gnatO " flag, permitting compilation database
  fragments and sidecar output files to be written to arbitrary
  directories and desynchronizing flag argument parsing between the go
  command and the compiler driver so that subsequent arguments could be
  passed as unvalidated positional inputs to the linker.

  "-gen-" and "-gnat" flags are now disallowed in "#cgo" compiler and
  linker flags.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97035 and Go issue https://go.dev/issue/82575.

- cmd/go: arbitrary code execution during build on darwin via "-l
  to_library" in cgo

  On Darwin, building a malicious package that uses cgo could cause
  arbitrary code execution when using the Apple linker due to passing
  "-l to_library " in a "#cgo LDFLAGS" directive.

  The Apple linker recombines the separated arguments "-l" and
  "to_library" into "-lto_library", which loads an arbitrary LTO plugin
  dynamic library at link time.

  The go command now disallows "-l" followed by "to_library" in "#cgo
  LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden",
  "-library", and "-library-path", and checks recombined "-l" arguments
  against disallowed linker flags and patterns.

  Thanks to Ali Sherif for reporting this issue.

  This is CVE-2026-97036 and Go issue https://go.dev/issue/82574.

- cmd/go: linker script injection via split -Wl, flags and Darwin or
  symbol linker flags in cgo

  Building a malicious package that uses cgo could cause arbitrary code
  execution at link time by passing linker script files to the host
  linker via "#cgo LDFLAGS".

  Split "-Wl," flags that consume a following argument (such as
  "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously
  accepted a bare second argument without a "-Wl," prefix, which the
  compiler driver passes directly to the linker as a positional input
  file. Additionally, when using GNU ld.bfd, flags such as "-framework",
  "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R",
  "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate"
  could cause ld.bfd to interpret their arguments as linker scripts if
  they named a regular file on disk.

  The go command now requires a "-Wl," prefix on the second token of
  split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not
  reference linker script files, and disallows bare
  "-Wl,--warn-backrefs-exclude".

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97037 and Go issue https://go.dev/issue/82573.

- cmd/go: arbitrary code execution via crafted .syso files and cgo
  linker input files

  Building a malicious package containing ".syso" files or cgo linker
  inputs could inject arbitrary linker flags or execute arbitrary code
  at link time.

  Linker input files—including ".syso" files, direct object or library
  inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were
  passed to the external linker without validating their format or
  checking for embedded linker options. Across platforms, this allowed
  executing GNU ld implicit linker scripts disguised as libraries or
  ".syso" files (or loaded via "-l:" or "-l" containing path
  separators), injecting unallowlisted linker flags via PE/COFF
  ".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load
  commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO
  intermediate representation sections in ELF, PE/COFF, or Mach-O
  objects.

  The go command now verifies that ".syso" files, direct linker inputs,
  and libraries in "-L" directories are valid binary objects or archives
  that do not contain unallowlisted ".drectve" directives,
  "LC_LINKER_OPTION" load commands, or LTO IR sections, and disallows
  "-l:" and ":", "=", or path separators in "-l" flags.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97038 and Go issue https://go.dev/issue/82572.

- cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives

  Building a malicious package that uses "#cgo pkg-config:" directives
  could load untrusted pkg-config ".pc" files or inject unvalidated
  compiler and linker flags.

  The pkg-config flag allowlist previously permitted "--with-path=" and
  "--personality=", allowed "--define-variable=" values beginning with
  "=" or "$" (which can rewrite paths in system ".pc" files into
  sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and
  allowed package arguments ending in ".pc" or containing path
  separators or "..", which caused pkg-config to load local ".pc" files
  directly from the package directory. In addition, flags returned by
  "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining
  whether internal linking is safe.

  The go command now disallows "--with-path=", "--personality=", leading
  "=" or "$" characters in "--define-variable=" values, and local ".pc"
  paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when
  checking internal linking compatibility.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97039 and Go issue https://go.dev/issue/82571.

- cmd/go, cmd/link: cgo directive injection via .syso files disguised as
  Go object files

  Building a package containing a crafted ".syso" file could bypass cgo
  flag validation and inject arbitrary linker flags when linking.

  When loading ".syso" entries from a package archive, the linker only
  checked for recognized host object headers (ELF, Mach-O, PE, and
  XCOFF) before falling through to Go object parsing. A ".syso" file
  beginning with a "go object" header was parsed as a Go compiler
  object, allowing untrusted cgo metadata directives (such as
  "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to
  be passed to the external linker without validation. Additionally,
  ".syso" filenames longer than 16 bytes lost their ".syso" extension
  when truncated in archive headers, and unrecognized ".syso" formats
  forced external linking in pure-Go builds.

  The linker now rejects ".syso" files that are not recognized host
  object formats, and "cmd/go" and "cmd/pack" preserve the ".syso"
  suffix when truncating long archive member names.

  Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for
  reporting this issue.

  This is CVE-2026-97040 and Go issue https://go.dev/issue/82570.

- cmd/compile, cmd/link: host linker flag injection via //go:cgo_*
  directives

  Building a malicious package containing "//go:cgo_*" compiler
  directives could inject arbitrary flags into the external linker
  invocation on ELF platforms.

  The compiler and linker did not reject commas in
  "//go:cgo_import_dynamic", "//go:cgo_export_dynamic",
  "//go:cgo_export_static", "//go:cgo_import_static", and
  "//go:cgo_dynamic_linker" directives, and the linker passed the
  dynamic linker path using "-Wl,--dynamic-linker,". Furthermore, the
  two-argument form of "//go:cgo_import_dynamic" (which is permitted in
  non-cgo Go source files) could overwrite the external symbol name of a
  symbol already marked for cgo export. A symbol name or dynamic linker
  path containing a comma or leading "@" could split
  "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into
  arbitrary host linker flags or response file arguments.

  The compiler and linker now reject commas in "//go:cgo_*" symbol and
  dynamic linker directives, the linker passes "-Wl,--dynamic-linker=",
  and "cgo_import_dynamic" no longer overwrites symbols exported via
  "cgo_export_dynamic" or "cgo_export_static".

  Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for
  reporting this issue.

  This is CVE-2026-97041 and Go issue https://go.dev/issue/82569.

- cmd/cgo, cmd/compile, cmd/link: linker flag injection via
  cgo_import_dynamic and PE DLL names

  Building a malicious package that uses "//go:cgo_import_dynamic" or
  links against a crafted PE object on Windows could pass unsafe library
  arguments to the external linker.

  The compiler only checked the first character of the library name in
  "//go:cgo_import_dynamic" directives and skipped validation in
  cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link"
  did not validate imported DLL names extracted from PE object files
  before emitting "-l" flags for the external linker, allowing a crafted
  DLL name containing ".." path traversal or special characters to
  reference arbitrary files on disk.

  The compiler now validates every character of the library name in
  "//go:cgo_import_dynamic" directives (including in cgo-generated files
  on Windows) and rejects ".." path traversal, and "cmd/cgo" and
  "cmd/link" reject PE imported DLL names containing path separators,
  "..", ":", or leading "-" or "@".

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97042 and Go issue https://go.dev/issue/82568.

- cmd/go, cmd/compile: unexpected code execution via escaped quotes in
  //go:cgo_ldflag

  Building a malicious package that uses cgo could bypass "#cgo LDFLAGS"
  validation and cause unexpected code execution at build time, or cause
  the go command to panic, via crafted quoting in "//go:cgo_ldflag"
  directives.

  When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo
  LDFLAGS" argument with strconv.Quote in a "//go:cgo_ldflag" directive,
  but "cmd/compile" and "cmd/go" parsed those directives by splitting on
  raw quote characters without handling backslash escapes or unquoting
  the string. This mismatch allowed disallowed linker flags or
  unvalidated linker search paths to be smuggled past the go command's
  flag checks and passed to the external linker. In addition,
  deduplicating LDFLAGS in the go command could panic with an
  out-of-bounds slice index when a prefix of the flag list matched near
  the end of the slice.

  "cmd/compile" and "cmd/go" now properly handle backslash-escaped
  quotes and unquote "//go:cgo_*" pragma strings with strconv.Unquote,
  and the slice bounds check in processCgoOutputs has been fixed.

  This issue was found by the Go Security Team during an internal audit.

  This is CVE-2026-97043 and Go issue https://go.dev/issue/82567.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.27.4


To generate a diff of this commit:
cvs rdiff -u -r1.258 -r1.259 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.9 -r1.10 pkgsrc/lang/go126/PLIST
cvs rdiff -u -r1.11 -r1.12 pkgsrc/lang/go126/distinfo
cvs rdiff -u -r1.3 -r1.4 pkgsrc/lang/go127/PLIST
cvs rdiff -u -r1.4 -r1.5 pkgsrc/lang/go127/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.258 pkgsrc/lang/go/version.mk:1.259
--- pkgsrc/lang/go/version.mk:1.258     Tue Oct 20 20:26:44 2026
+++ pkgsrc/lang/go/version.mk   Tue Nov 10 18:36:58 2026
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.258 2026/10/20 20:26:44 bsiegert Exp $
+# $NetBSD: version.mk,v 1.259 2026/11/10 18:36:58 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -6,8 +6,8 @@
 #
 .include "go-vars.mk"
 
-GO127_VERSION= 1.27.3
-GO126_VERSION= 1.26.10
+GO127_VERSION= 1.27.4
+GO126_VERSION= 1.26.11
 GO125_VERSION= 1.25.14
 GO124_VERSION= 1.24.13
 GO123_VERSION= 1.23.12

Index: pkgsrc/lang/go126/PLIST
diff -u pkgsrc/lang/go126/PLIST:1.9 pkgsrc/lang/go126/PLIST:1.10
--- pkgsrc/lang/go126/PLIST:1.9 Tue Oct 13 18:36:05 2026
+++ pkgsrc/lang/go126/PLIST     Tue Nov 10 18:36:58 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.9 2026/10/13 18:36:05 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.10 2026/11/10 18:36:58 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go126/CONTRIBUTING.md
@@ -8882,6 +8882,7 @@ go126/src/net/http/h2_error_test.go
 go126/src/net/http/header.go
 go126/src/net/http/header_test.go
 go126/src/net/http/http.go
+go126/src/net/http/http1_server_test.go
 go126/src/net/http/http_test.go
 go126/src/net/http/httptest/example_test.go
 go126/src/net/http/httptest/httptest.go
@@ -14168,7 +14169,9 @@ go126/test/fixedbugs/issue8154.go
 go126/test/fixedbugs/issue8155.go
 go126/test/fixedbugs/issue8158.go
 go126/test/fixedbugs/issue81612.go
+go126/test/fixedbugs/issue81687.go
 go126/test/fixedbugs/issue8183.go
+go126/test/fixedbugs/issue81863.go
 go126/test/fixedbugs/issue8280.dir/a.go
 go126/test/fixedbugs/issue8280.dir/b.go
 go126/test/fixedbugs/issue8280.go

Index: pkgsrc/lang/go126/distinfo
diff -u pkgsrc/lang/go126/distinfo:1.11 pkgsrc/lang/go126/distinfo:1.12
--- pkgsrc/lang/go126/distinfo:1.11     Tue Oct 20 20:26:44 2026
+++ pkgsrc/lang/go126/distinfo  Tue Nov 10 18:36:58 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.11 2026/10/20 20:26:44 bsiegert Exp $
+$NetBSD: distinfo,v 1.12 2026/11/10 18:36:58 bsiegert Exp $
 
-BLAKE2s (go1.26.10.src.tar.gz) = 3e01a840b0738fe754af414be33edf79e134e29edda5000b05bcded599a2c04b
-SHA512 (go1.26.10.src.tar.gz) = 0de2cc2c331ea0ca4b3bb41b33d6bad3131c8063cd5ae7ddd1ea9ab974fa9a472cb504a88b68cb32b609dca4157c61b1b30d3029186c7bc00559a75cc254ec86
-Size (go1.26.10.src.tar.gz) = 34164741 bytes
+BLAKE2s (go1.26.11.src.tar.gz) = 5c8016d75ee1460a19928a0cbc79bb7a266cafff8f8335bf2c5fb1b80f7156d9
+SHA512 (go1.26.11.src.tar.gz) = e263b02a1b9af37dcbb9b26bc0d5f8ef6abc1d4eac319b32946c66a6fc77ee7e81d88e67a946eb92103e056e19c95186d77ebaea59d9ebbe7940e6da750db475
+Size (go1.26.11.src.tar.gz) = 34192889 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

Index: pkgsrc/lang/go127/PLIST
diff -u pkgsrc/lang/go127/PLIST:1.3 pkgsrc/lang/go127/PLIST:1.4
--- pkgsrc/lang/go127/PLIST:1.3 Tue Oct 13 18:36:05 2026
+++ pkgsrc/lang/go127/PLIST     Tue Nov 10 18:36:58 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.3 2026/10/13 18:36:05 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.4 2026/11/10 18:36:58 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go127/CONTRIBUTING.md
@@ -1520,6 +1520,7 @@ go127/src/cmd/compile/internal/types2/lo
 go127/src/cmd/compile/internal/types2/lookup_test.go
 go127/src/cmd/compile/internal/types2/main_test.go
 go127/src/cmd/compile/internal/types2/map.go
+go127/src/cmd/compile/internal/types2/methodorder_test.go
 go127/src/cmd/compile/internal/types2/mono.go
 go127/src/cmd/compile/internal/types2/mono_test.go
 go127/src/cmd/compile/internal/types2/named.go
@@ -14772,6 +14773,7 @@ go127/test/fixedbugs/issue8158.go
 go127/test/fixedbugs/issue81612.go
 go127/test/fixedbugs/issue81687.go
 go127/test/fixedbugs/issue8183.go
+go127/test/fixedbugs/issue81863.go
 go127/test/fixedbugs/issue8280.dir/a.go
 go127/test/fixedbugs/issue8280.dir/b.go
 go127/test/fixedbugs/issue8280.go

Index: pkgsrc/lang/go127/distinfo
diff -u pkgsrc/lang/go127/distinfo:1.4 pkgsrc/lang/go127/distinfo:1.5
--- pkgsrc/lang/go127/distinfo:1.4      Tue Oct 20 20:26:44 2026
+++ pkgsrc/lang/go127/distinfo  Tue Nov 10 18:36:58 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.4 2026/10/20 20:26:44 bsiegert Exp $
+$NetBSD: distinfo,v 1.5 2026/11/10 18:36:58 bsiegert Exp $
 
-BLAKE2s (go1.27.3.src.tar.gz) = 5da0317fa49d619e5f7cc9f10815c9b426cf614821393a075829d63af04f7b68
-SHA512 (go1.27.3.src.tar.gz) = dc84444e0e5e5d4f7bc00f4323ac88c2efa0ce2af4a6e3b3e60325a694389c7ec85ff3aaa9d80df9ff07a2c32620ba57b0c787475f44d80c57c0d22b5c63844c
-Size (go1.27.3.src.tar.gz) = 35134035 bytes
+BLAKE2s (go1.27.4.src.tar.gz) = a60de5ea3acff1d4609857193e0a93d7856de9fbe8d23a2388fbe6ad6b1c8ebd
+SHA512 (go1.27.4.src.tar.gz) = bc5cb8bd8a92293afbb0ea2d949453fede75706ee94147dd163b336913acb4b5cf3c41c861d7f0c1a4a6373856720eb44032bf5916054f0d8fb926657fb5b754
+Size (go1.27.4.src.tar.gz) = 35153471 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35