Go Vulnerability Database

• CVE-2026-97045
• Affects: golang.org/x/net
• Published: Oct 27, 2026

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

• CVE-2026-78661
• Affects: golang.org/x/net
• Published: Oct 27, 2026

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

• CVE-2026-111943
• Affects: crypto/x509
• Published: Oct 21, 2026

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

• CVE-2026-96627, GHSA-pw5q-rjx4-7f7p
• Affects: github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2
• Published: Oct 19, 2026
• Unreviewed

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend

• CVE-2026-96628, GHSA-mp22-58ff-6fhr
• Affects: github.com/getarcaneapp/arcane/backend, github.com/getarcaneapp/arcane/backend/v2
• Published: Oct 19, 2026
• Unreviewed

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend