go, branch go1.24.11

[release-branch.go1.24] go1.24.11

2025-12-02T16:04:21Z

Change-Id: Iae7d7cf17bf31ac6aaf145993d0b857a3ddbcacb Reviewed-on: https://go-review.googlesource.com/c/go/+/725841 TryBot-Bypass: Gopher Robot Reviewed-by: Mark Freeman Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov

[release-branch.go1.24] crypto/x509: prevent HostnameError.Error() from consuming excessive resource

2025-12-02T15:51:02Z

Constructing HostnameError.Error() takes O(N^2) runtime due to using a string concatenation in a loop. Additionally, there is no limit on how many names are included in the error message. As a result, a malicious attacker could craft a certificate with an infinite amount of names to unfairly consume resource. To remediate this, we will now use strings.Builder to construct the error message, preventing O(N^2) runtime. When a certificate has 100 or more names, we will also not print each name individually. Thanks to Philippe Antoine (Catena cyber) for reporting this issue. Updates #76445 Fixes #76460 Fixes CVE-2025-61729 Change-Id: I6343776ec3289577abc76dad71766c491c1a7c81 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3000 Reviewed-by: Neal Patel Reviewed-by: Damien Neil Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3220 Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/725820 Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov Reviewed-by: Mark Freeman

[release-branch.go1.24] crypto/x509: excluded subdomain constraints preclude wildcard SANs

2025-11-25T20:14:29Z

When evaluating name constraints in a certificate chain, the presence of an excluded subdomain constraint (e.g., excluding "test.example.com") should preclude the use of a wildcard SAN (e.g., "*.example.com"). Fixes #76442 Fixes #76463 Fixes CVE-2025-61727 Change-Id: I42a0da010cb36d2ec9d1239ae3f61cf25eb78bba Reviewed-on: https://go-review.googlesource.com/c/go/+/724401 Reviewed-by: Nicholas Husin Reviewed-by: Daniel McCarney LUCI-TryBot-Result: Go LUCI Reviewed-by: Nicholas Husin Reviewed-by: Neal Patel

[release-branch.go1.24] internal/cpu: use correct variable when parsing CPU features lamcas and lam_bh on loong64

2025-11-25T18:05:20Z

Fixes #76378 Change-Id: I5019f4e32243911f735f775bcb3c0dba5adb4162 Reviewed-on: https://go-review.googlesource.com/c/go/+/655395 Reviewed-by: David Chase Reviewed-by: Junyang Shao Reviewed-by: Meidan Li Reviewed-by: sophie zhao LUCI-TryBot-Result: Go LUCI (cherry picked from commit bcd0ebbd2abcd3e2e876862f287c46a2de56eaab) Reviewed-on: https://go-review.googlesource.com/c/go/+/722400 Reviewed-by: abner chenc Reviewed-by: Mark Freeman

[release-branch.go1.24] go1.24.10

2025-11-05T19:01:51Z

Change-Id: I74370108e95298bec0fe0f7738867072ece0d0ff Reviewed-on: https://go-review.googlesource.com/c/go/+/718063 TryBot-Bypass: Gopher Robot Auto-Submit: Gopher Robot Reviewed-by: Michael Knyszek Reviewed-by: Michael Pratt

[release-branch.go1.24] encoding/pem: properly calculate end indexes

2025-10-29T16:22:33Z

When a block is missing the END line trailer, calculate the indexes of the end and end trailer _before_ continuing the loop, making the reslicing at the start of the loop work as expected. Fixes #76028 Change-Id: If45c8cb473315623618f02cc7609f517a72d232d Reviewed-on: https://go-review.googlesource.com/c/go/+/714200 Auto-Submit: Roland Shoemaker Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI (cherry picked from commit 839da71f8907ac4434299db4353db31835c916df) Reviewed-on: https://go-review.googlesource.com/c/go/+/714680 Reviewed-by: David Chase

[release-branch.go1.24] encoding/pem: properly decode strange PEM data

2025-10-24T18:03:15Z

When the passed byte slice has leading garbage, properly handle ignoring it and continuing to parse the slice until we find a valid block (or nothing). Fixes #75951 Change-Id: I07e937d9c754fd71b028b99450b48f57b4464457 Reviewed-on: https://go-review.googlesource.com/c/go/+/712140 Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI (cherry picked from commit 09830901714d8b3a2cc5fb33e87a81886b21ea24) Reviewed-on: https://go-review.googlesource.com/c/go/+/712641 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.24] net/url: allow IP-literals with IPv4-mapped IPv6 addresses

2025-10-17T22:02:30Z

The security fix we applied in CL709857 was overly broad. It applied rules from RFC 2732, which disallowed IPv4-mapped IPv6 addresses, but these were later allowed in RFC 3986, which is the canonical URI syntax RFC. Revert the portion of CL709857 which restricted IPv4-mapped addresses, and update the related tests. Updates #75815 Fixes #75831 Change-Id: I3192f2275ad5c386f5c15006a6716bdb5282919d Reviewed-on: https://go-review.googlesource.com/c/go/+/710375 LUCI-TryBot-Result: Go LUCI Reviewed-by: Ethan Lee Auto-Submit: Roland Shoemaker (cherry picked from commit 9db7e30bb42eed9912f5e7e9e3959f3b38879d5b) Reviewed-on: https://go-review.googlesource.com/c/go/+/712142 Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

[release-branch.go1.24] go1.24.9

2025-10-13T21:14:38Z

Change-Id: I6deccf317a5f19ca9ee2a2eaddf65203ecfeb665 Reviewed-on: https://go-review.googlesource.com/c/go/+/711461 Auto-Submit: Gopher Robot Reviewed-by: Michael Pratt TryBot-Bypass: Gopher Robot Reviewed-by: Carlos Amedee

[release-branch.go1.24] crypto/x509: rework fix for CVE-2025-58187

2025-10-13T15:39:27Z

In CL 709854 we enabled strict validation for a number of properties of domain names (and their constraints). This caused significant breakage, since we didn't previously disallow the creation of certificates which contained these malformed domains. Rollback a number of the properties we enforced, making domainNameValid only enforce the same properties that domainToReverseLabels does. Since this also undoes some of the DoS protections our initial fix enabled, this change also adds caching of constraints in isValid (which perhaps is the fix we should've initially chosen). Updates #75835 Updates #75828 Fixes #75860 Change-Id: Ie6ca6b4f30e9b8a143692b64757f7bbf4671ed0e Reviewed-on: https://go-review.googlesource.com/c/go/+/710735 LUCI-TryBot-Result: Go LUCI Reviewed-by: Damien Neil (cherry picked from commit 1cd71689f2ed8f07031a0cc58fc3586ca501839f) Reviewed-on: https://go-review.googlesource.com/c/go/+/710879 Reviewed-by: Michael Pratt Auto-Submit: Michael Pratt