最新のセキュリティ情報
10月21日(水)昨日
Help set Go's priorities for next year
Share your experience with Go in the 2026 Go Developer Survey, open through November 3.
10月20日(火)
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
影響: go:github.com/klauspost/compress <= 1.18.6 → 1.18.7 Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. Package - Name: github.com/klauspost/compress/s2 - Ecosystem: Go - Affected ve…
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
影響: go:github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1 → 1.2.0-rc1 Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller's identity, so any client that obtains a session ID…
10月17日(土)
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0 Summary A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.11.0 → 2.11.0 Summary Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c). This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can acc…
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
影響: go:github.com/getkin/kin-openapi <= 0.145.0 → 0.146.0 Summary ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path. Affects github.com/getkin/kin-openapi 0 { Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough,…
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
影響: go:github.com/coredns/coredns >= 1.9.4, <= 1.14.4 → 1.14.5 Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8s_external transferer can emit an empty []dns.RR batch, and the shared transfer plugin indexes records[0] without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as SERVFAIL, but repeated tr…
gomarkdown/markdown IsSafeURL panics on short URLs
影響: go:github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971 → 0.0.0-20260724235538-61af6e1e6971 Summary IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path :=…
10月16日(金)
Interactive refactoring in gopls
Introducing interactive refactoring in gopls and the LSP: a new capability that brings dynamic, multi-step refactorings into your favorite editor.
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3 Impact Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…
SFTPGo source-side file-pattern filter bypass during copy operations
影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6 Summary File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…
containerd: Unpack DoS via repeated opaque whiteouts
影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5 Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
影響: go:github.com/docker/distribution <= 2.8.3, go:github.com/distribution/distribution/v3 < 3.1.2 → 3.1.2 Summary registry/client.(manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pu…
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
影響: go:github.com/getkin/kin-openapi >= 0.136.0, < 0.149.0 → 0.149.0 Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone parseArray function, the top-level array check in UrlencodedBodyDecoder, and MultipartBodyDecoder. Three additional crash paths were missed. All of them reach the unguarded urlValuesDecoder.parseArray method (openapi3filter/req_resp_decoder.go:576) or the u…
10月14日(水)
Better HTTP/1 connection reuse
Go 1.27 includes a change to the HTTP client that can make programs sending many sequential HTTP/1 requests significantly faster.
10月2日(金)
Arch-specific SIMD in Go
Go 1.27 introduces experimental arch-specific SIMD vector APIs
9月24日(木)
Platform-independent SIMD in Go
Go 1.27 adds an experimental platform-agnostic SIMD API
9月16日(水)
Size-Specialized Memory Allocation
Go 1.27 improves performance of small allocations using size-specialized allocation functions.
9月2日(水)
Goroutine Leak Profiles
Go 1.27 includes new goroutine leak profiles.
8月26日(水)
Generic Methods
Go 1.27 adds generic methods—a highly desired language feature.
8月19日(水)
Go 1.27 is released
Go 1.27 adds generic methods, encoding/json/v2 package, uuid package, faster memory allocation, goroutine leak profiles, and more.
7月30日(木)
How the controller-runtime Cache Actually Works, and Why Your Controller Does Not Crash the API Server
This article has been revised since it was first published, to correct several significant technical inaccuracies in the original text. Kubernetes has long been the default platform for distributed workloads, and writing your own controller for it is now a matter of a few hours. The common path — Golang, using kubebuilder on top of controller-runtime — gives you a project scaffold, types, and a reconciler. For typical scenarios that is more than enough. But as soon as load grows or the controller starts behaving in ways you did not expect, a whole class of edge cases shows up. Most of them tr…
5月21日(木)
Introducing the pkg.go.dev API
Introducing the new programmatic API for pkg.go.dev, allowing developers to fetch package and module data directly.
6月6日(月)
DevConf 2016
DevConf 2016 in Moscow, Russia on June 17-18. DevConf is the ultimate meeting place for russian-speaking web-developers, combining several language-specific conferences under one roof. This year the conference will take place in . Skolkovo Moscow School of Management DevConf 2016 will include the following sections: DevConf::PHP(); DevConf::Python(); DevConf::Javascript(); DevConf::Storage(); DevConf::Golang(); DevConf::DevOps(); DevConf::Ruby(); Each section will feature several talks from the active contributors/authors of the language. Among the invited speakers are Dmitry Stogov (Zend), E…