mirror of
https://github.com/rclone/rclone.git
synced 2026-10-28 14:28:38 -04:00
Nick Craig-Wood
dab9ecd9fc
- CVE-2026-97032: net/http: HTTP/2 server crash due to HPACK encoder race - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers - CVE-2026-97031: crypto/tls: reject malformed ECH outer extension references - CVE-2026-94444: cmd/go: checksum bypass for golang.org/fips140 - CVE-2026-94447: cmd/go: checksum database bypass for golang.org/toolchain - CVE-2026-94448: html/template: reset context tracking on consecutive template expressions - CVE-2026-97030: html/template: recognize |yield| as regexp preceder keyword - CVE-2026-94440: net/textproto, mime/multipart: memory limit bypass when parsing MIME headers - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection - CVE-2026-94439: net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows - CVE-2026-78667: net/http: lack of limit on size of parsed Range headers - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams This also updates the go1.26 test job to go1.26.9 which contains the same fixes.