Go programs hit by Linux MPTCP use-after-free CVE-2026-98432
🐿️ GoDaily - November 2, 2026
The golang-announce thread on CVE-2026-98432 is the one to open first: Go programs enable MPTCP by default on Linux, which pulls them into the kernel's TCP use-after-free bug whether the author asked for it or not. Alongside that, there's a proposal to spin out a unicode/ascii package of common ASCII helpers, and another to publish the analyzers currently buried inside gopls so the rest of the tooling ecosystem can actually use them.
Proposals 2
Background: In https://github.com/golang/go/issues/82464 issuecomment-6535278944, @hyangah suggested that we publish some of the analyzers currently i
This is a proposal for a new package, unicode/ascii , with the following contents: go // Package ascii implements functions to support text encoded in
Conferences 1
GC
Discussions 8
TIL: My https:// gokrazy.org/ appliance platform was helpful in the MARLIN project, an effort by the European Space Agency to monitor responsible fishing: https:// resilience.esa.int/archives/pr oject
ual v0.7.6 is out ual is a stack-based, coordination-first language: one interpreter, compilers to Go and Rust. New: cual/SDCC . This release adds a simple experimental C backend for the Z80 (ZX Spect
Been on annual leave all week, and today is the first day I actually wanted to code, and I enjoyed it again. Took a moment to fill in the GoLang dev survey (no, I am not fucking using agents, stop ask
I benchmarked Go 1.28 HTTP/2 parking with 5,000 idle connections. Across three runs, the same server binary used 85-93 MiB less RSS with parking enabled.
Road to Italy! 2 days, 2 conferences, 2 closing talks. First @ golab in Bologna on Monday, then Espressif DevCon in Milan on Tuesday. Let's Go! golang tinygo golab espressif
I cannot fathom this table of which kernels are vulnerable. It seems to have massive holes in the version spans: https://nvd.nist.gov/vuln/detail/cve-2026-98432 Has anyone deciphered which kernel vers
Events 1
Articles 5
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine ...
What if you could build a fast API, compile it into a single binary, run thousands of concurrent...
Protect an MCP server in Go with OAuth 2.1: publish RFC 9728 metadata, verify bearer tokens and enforce per-tool scopes, with code you can copy and adapt.
Summary Available fixed versions The issue is fixed in the following versions: The 2025.2.6. updates for all IDEs now contain only the JBR fix. They will get a separate hotfix for the JCEF problem. Un
A few months back, one of our product managers asked a seemingly harmless question in our internal Slack: “Can we just paste customer… Continue reading on Medium »
Videos 5
This is a quick and painless tutorial on starting to implement Coreutils 'ls' in Go. Repo: https://github.com/tonybanters/go-lsbtw ...
Build Go backends where a new feature doesn't break three others ...
Six hundred photos. Two minutes of waiting. Add one word, go, and the same job takes about fifteen seconds. In 70 seconds: the ...
We've got Nick Gerace back! Last time he was on he was at System Initiative, but now he's joined our very own Steve Klabnik at East River Source Control! Kris and Matt catch up with Nick on the move f
MQTT 5 in Go with autopaho from eclipse/paho.golang: paho vs autopaho, autopaho.ClientConfig, subscribing in ...
Trending 2
pull request.base.sha does not follow main, so PRs opened before 6731 kept running the old check-quality script, Go Report Card check included. Check out github.sha (the base branch tip for pull reque
Social 2
Road to Italy! 2 days, 2 conferences, 2 closing talks. First @golab.io in Bologna on Monday, then Espressif DevCon in Milan on Tuesday. Let's Go! golang tinygo golab espressif
Leoxy is now public and ready for testing! Developers, try it, benchmark it, stress-test it, break it, and point out every flaw you find. Bug reports, harsh criticism, feedback, and contributions are
Enjoying this issue? Share it →