These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-39821 is a critical vulnerability in the Golang Net package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation. This issue can allow an attacker to bypass security checks, as a program may reject a Punycode-encoded label but inadvertently permit access to its Unicode equivalent.
CVE-2026-39820 is a high-severity vulnerability in the Go programming language, which can be exploited through well-crafted inputs to the ParseAddress, ParseAddressList, and ParseDate functions. This vulnerability leads to excessive CPU exhaustion and memory allocations, potentially causing denial-of-service (DoS) attacks. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. It affec [truncated]
A high-severity vulnerability, CVE-2026-33810, was found in Go's certificate chain validation process. The issue arises when verifying a certificate chain containing excluded DNS constraints, which are not correctly applied to wildcard DNS SANs using a different case than the constraint. This vulnerability affects validation of otherwise trusted certificate chains issued by a root CA in the VerifyOptions. [truncated]
CVE-2026-32289 is a MEDIUM severity vulnerability in Go, allowing for XSS attacks via improper escaping of content in JS template literals. The issue arises from the incorrect tracking of context across template branches and brace depth within JS template literals, leading to potentially incorrect escaping of content. This vulnerability could cause actions within JS template literals to be incorrectly or [truncated]
A vulnerability in the Go programming language's tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the 'old GNU sparse map' format. This issue has been assigned a CVSS score of 5.5 and a severity of MEDIUM. The vulnerability exists due to the lack of proper memory allocation checks in the tar.Reader compo [truncated]
A vulnerability in the Go programming language, specifically in the Root.Chmod function, allows for symlink traversal on Linux systems. This issue arises when the target of Root.Chmod is replaced with a symlink during the chmod operation, potentially allowing the operation to affect targets outside the root directory. The impact is limited due to checks performed by Root.Chmod, which returns an error if t [truncated]
CVE-2026-32281 is a high-severity vulnerability in Golang's Go, affecting certificate chain validation. When certificates in the chain contain a very large number of policy mappings, it can cause denial of service. This issue only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
A high-severity vulnerability, CVE-2026-27144, was found in the Go programming language. The compiler failed to correctly determine non-overlapping moves due to a no-op interface conversion, potentially causing memory corruption. This issue can impact developers and organizations using the Go programming language, as it may lead to runtime memory corruption if exploited. The vulnerability has a CVSS score [truncated]
CVE-2026-27137 is a high-severity vulnerability in the Go programming language. The vulnerability occurs when verifying a certificate chain containing multiple email address constraints with common local portions but different domain portions. In such cases, the constraints are not properly applied, and only the last constraint is considered. This vulnerability has a CVSS score of 7.5 and a HIGH severity [truncated]
CVE-2025-61732 is a high severity vulnerability in Go, with a CVSS score of 8.6. The vulnerability allows for code smuggling into the resulting cgo binary due to a discrepancy between how Go and C/C++ comments were parsed. This issue was published on February 5, 2026, and last modified on June 30, 2026. The CVE record and NVD detail pages provide more information on this vulnerability. A patch is availabl [truncated]