Go Security Advisory: Root Escape via os.Open Symlink & TLS ECH Privacy Leak (CVE-2026-39822, CVE-2026-42505)

Vulnerability Overview Go 1.26.5 and Go 1.25.12 have been released, containing two security fixes. Impact Scope 1. os: Root escape via symlink plus trailing slash - On Unix systems, when the last component of a path is a symbolic link and the path ends with , incorrectly follows the symbolic link to a location outside the root directory. - For example, opens the symbolic link pointed to by , even if is a symbolic link pointing outside the root directory. - On Unix, in the argument of follows symbolic links, even if the path ends with . The root handling failed to sanitize this behavior, allowing paths ending with to escape. - It now sanitizes the path argument provided to . 2. crypto/tls: Encrypted Client Hello privacy leak - The Encrypted Client Hello implementation leaks pre-shared key identities during the handshake, allowing passive network observers to de-anonymize the server's hostname by collecting handshake data, even when ECH is in use. Remediation For the vulnerability, the path argument provided to is now sanitized. For the vulnerability, specific remediation details are not described in detail in the screenshots but are included in the Go 1.26.5 and Go 1.25.12 releases. POC Code Related Links CVE-2026-39822: https://go.dev/dev/issue/79005 CVE-2026-42505: https://go.dev/dev/issue/79282 Download and Build Binary and source distributions can be downloaded from the Go website: https://go.dev/dl/ Clone the source code using Git, update to the release version, and compile using and . Acknowledgments Thanks to Mundur (https://github.com/M0nd050) for reporting the first issue. Thanks to Coia Prant (github.com/bqav) for reporting the second issue. Privacy Taiyang Yang and David are part of the Go team.

Goal Reached Thanks to every supporter — we hit 100%!

Go Security Advisory: Root Escape via os.Open Symlink & TLS ECH Privacy Leak (CVE-2026-39822, CVE-2026-42505)