USN-8883-2: Go vulnerability
Publication date
15 October 2026
Overview
Go could allow unintended access to network services.
Releases
Packages
- golang-1.23 - Go programming language compiler
Details
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This
update provides the corresponding fix for Go version 1.23.
Original advisory details:
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This
update provides the corresponding fix for Go version 1.23.
Original advisory details:
It was discovered that the Go x/net/idna package incorrectly handled
certain Punycode-encoded labels that decoded to ASCII-only labels. An
attacker could possibly use this issue to bypass hostname-based access
controls and escalate privileges.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 22.04 LTS jammy | golang-1.23 – 1.23.1-1~22.04.3 | ||
| golang-1.23-go – 1.23.1-1~22.04.3 | |||
| golang-1.23-src – 1.23.1-1~22.04.3 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.