Skip to content

CVE-2026-56858 on CTRL-OS 26.05

Aliases: CVE-2026-56858

Packages: go_1_27

Status: In Progress, Resolved

Advisory Information

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Updates

2026-08-17 11:43 CEST

Metadata changes:

  • Status for package go_1_27: “Resolved” (e5bcd467cf926a27830bf0bced347f434271ac0c)

2026-08-17 11:41 CEST

Metadata changes:

  • Status for package go: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)
  • Status for package go_1_26: “In Progress” (caf3d299c87a63b58deab6b597dc7adf4f762ba1)

2026-08-17 11:39 CEST

Metadata changes:

  • Status for package go_1_25: “Resolved” (95b632a8007bdaebc2c08b6e07292702eceade51)

Comment:

Fixed by updating to Go 1.25.3.

2026-08-17 11:38 CEST

Metadata changes:

  • Status for package go: “Acknowledged”
  • Status for package go_1_25: “Acknowledged”
  • Status for package go_1_26: “Acknowledged”