go, branch go1.24.12

[release-branch.go1.24] go1.24.12

2026-01-15T18:28:38Z

Change-Id: I10f61b9036c64c5cbd760cc9f8db67344d373686 Reviewed-on: https://go-review.googlesource.com/c/go/+/736762 Reviewed-by: Michael Pratt Auto-Submit: Gopher Robot TryBot-Bypass: Gopher Robot Reviewed-by: Junyang Shao

[release-branch.go1.24] archive/zip: reduce CPU usage in index construction

2026-01-15T18:14:26Z

Constructing the zip index (which is done once when first opening a file in an archive) can consume large amounts of CPU when processing deeply-nested directory paths. Switch to a less inefficient algorithm. Thanks to Jakub Ciolek for reporting this issue. goos: darwin goarch: arm64 pkg: archive/zip cpu: Apple M4 Pro │ /tmp/bench.0 │ /tmp/bench.1 │ │ sec/op │ sec/op vs base │ ReaderOneDeepDir-14 25983.62m ± 2% 46.01m ± 2% -99.82% (p=0.000 n=8) ReaderManyDeepDirs-14 16.221 ± 1% 2.763 ± 6% -82.96% (p=0.000 n=8) ReaderManyShallowFiles-14 130.3m ± 1% 128.8m ± 2% -1.20% (p=0.003 n=8) geomean 3.801 253.9m -93.32% Fixes #77102 Fixes CVE-2025-61728 Change-Id: I2c9c864be01b2a2769eb67fbab1b250aeb8f6c42 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3060 Reviewed-by: Nicholas Husin Reviewed-by: Neal Patel Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3328 Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/736703 TryBot-Bypass: Michael Pratt Auto-Submit: Michael Pratt Reviewed-by: Junyang Shao

[release-branch.go1.24] net/url: add urlmaxqueryparams GODEBUG to limit the number of query parameters

2026-01-15T18:14:22Z

net/url does not currently limit the number of query parameters parsed by url.ParseQuery or URL.Query. When parsing a application/x-www-form-urlencoded form, net/http.Request.ParseForm will parse up to 10 MB of query parameters. An input consisting of a large number of small, unique parameters can cause excessive memory consumption. We now limit the number of query parameters parsed to 10000 by default. The limit can be adjusted by setting GODEBUG=urlmaxqueryparams=. Setting urlmaxqueryparams to 0 disables the limit. Thanks to jub0bs for reporting this issue. Fixes #77101 Fixes CVE-2025-61726 Change-Id: Iee3374c7ee2d8586dbf158536d3ade424203ff66 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3020 Reviewed-by: Nicholas Husin Reviewed-by: Neal Patel Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3326 Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/736702 Auto-Submit: Michael Pratt Reviewed-by: Junyang Shao TryBot-Bypass: Michael Pratt

[release-branch.go1.24] cmd/go/internal/work: sanitize flags before invoking 'pkg-config'

2026-01-15T18:14:19Z

The addition of CgoPkgConfig allowed execution with flags not matching the safelist. In order to prevent potential arbitrary code execution at build time, ensure that flags are validated prior to invoking the 'pkg-config' binary. Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Fixes CVE-2025-61731 Fixes #77100 Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240 Reviewed-by: Nicholas Husin Reviewed-by: Damien Neil Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3344 Reviewed-by: Neal Patel Reviewed-on: https://go-review.googlesource.com/c/go/+/736701 Auto-Submit: Michael Pratt TryBot-Bypass: Michael Pratt Reviewed-by: Junyang Shao

[release-branch.go1.24] crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone

2026-01-15T18:10:59Z

Once a tls.Config is used, it is not safe to mutate. We provide the Clone method in order to allow users to copy and modify a Config that is in use. If Config.SessionTicketKey is not populated, and if Config.SetSessionTicketKeys has not been called, we automatically populate and rotate session ticket keys. Clone was previously copying these keys into the new Config, meaning that two Configs could share the same auto-rotated session ticket keys. This could allow sessions to be resumed across different Configs, which may have completely different configurations. This change updates Clone to not copy the auto-rotated session ticket keys. Additionally, when resuming a session, check that not just that the leaf certificate is unexpired, but that the entire certificate chain is still unexpired. Fixes #77113 Fixes CVE-2025-68121 Change-Id: I011df7329de83068d11b3f0c793763692d018a98 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3300 Reviewed-by: Damien Neil Reviewed-by: Nicholas Husin Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3322 Reviewed-by: Neal Patel Reviewed-on: https://go-review.googlesource.com/c/go/+/736700 TryBot-Bypass: Michael Pratt Reviewed-by: Junyang Shao Auto-Submit: Michael Pratt

[release-branch.go1.24] crypto/tls: reject trailing messages after client/server hello

2026-01-07T21:28:54Z

For TLS 1.3, after procesesing the server/client hello, if there isn't a CCS message, reject the trailing messages which were appended to the hello messages. This prevents an on-path attacker from injecting plaintext messages into the handshake. Additionally, check that we don't have any buffered messages before we switch the read traffic secret regardless, since any buffered messages would have been under an old key which is no longer appropriate. We also invert the ordering of setting the read/write secrets so that if we fail when changing the read secret we send the alert using the correct write secret. Updates #76443 Fixes #76854 Fixes CVE-2025-61730 Change-Id: If6ba8ad16f48d5cd5db5574824062ad4244a5b52 Reviewed-on: https://go-review.googlesource.com/c/go/+/724120 LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Knyszek Reviewed-by: Daniel McCarney Reviewed-by: Coia Prant (cherry picked from commit 5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7) Reviewed-on: https://go-review.googlesource.com/c/go/+/731961 Reviewed-by: Damien Neil

[release-branch.go1.24] cmd/compile: handle propagating an out-of-range jump table index

2026-01-07T17:25:41Z

For an out-of-range jump table index, the constant facts should not be propagated to the destinations. Fixes #76966 Change-Id: Iff29814cb466c7aaa432cec212e5387665c45afc Reviewed-on: https://go-review.googlesource.com/c/go/+/731860 Auto-Submit: Cuong Manh Le Reviewed-by: David Chase Reviewed-by: Cherry Mui LUCI-TryBot-Result: Go LUCI Reviewed-on: https://go-review.googlesource.com/c/go/+/732480 Reviewed-by: Michael Knyszek Auto-Submit: Junyang Shao Commit-Queue: Junyang Shao Reviewed-by: Junyang Shao

[release-branch.go1.24] runtime: mark getfp as nosplit

2025-12-30T01:52:19Z

When compiling with -l, we can't take a stack split here. Fixes #76760 Change-Id: Ieab1225c6259c7f16bb5188aa84bff615d9db2e5 Reviewed-on: https://go-review.googlesource.com/c/go/+/728060 LUCI-TryBot-Result: Go LUCI Auto-Submit: Keith Randall Reviewed-by: Cherry Mui Reviewed-by: Keith Randall (cherry picked from commit d4972f6295aede2ddc35bcb1da5f6351623e9e4d) Reviewed-on: https://go-review.googlesource.com/c/go/+/728580

[release-branch.go1.24] runtime/race: set missing argument frame for ppc64x atomic And/Or wrappers

2025-12-29T20:53:21Z

The ppc64x TSAN wrappers for atomic And/Or did not initialize R6 with the Go argument frame before calling racecallatomic. Since racecallatomic expects R6 to point to the argument list and dereferences it unconditionally, this led to a nil-pointer dereference under -race. Other atomic TSAN wrappers (Load/Store/Add/Swap/CAS) already set up R6 in the expected way. This change aligns the And/Or wrappers with the rest by adding the missing R6 initialisation. This keeps the behavior consistent across all atomic operations on ppc64x. Fixes #76796. Change-Id: Iaf578449a6171a0c6f7c33ec6f64c1251297ae6d Reviewed-on: https://go-review.googlesource.com/c/go/+/718560 Reviewed-by: Mark Freeman LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui Reviewed-by: Paul Murphy (cherry picked from commit 44cb82449e7f24530fe0fe0bf8261ba9e0e4e7d8) Reviewed-on: https://go-review.googlesource.com/c/go/+/729420 Reviewed-by: Roland Shoemaker

[release-branch.go1.24] os: allow direntries to have zero inodes on Linux

2025-12-19T17:55:33Z

Some Linux filesystems have been known to return valid enties with zero inodes. This new behavior also puts Go in agreement with recent glibc. Fixes #76624 Change-Id: Ieaf50739a294915a3ea2ef8c5a3bb2a91a186881 GitHub-Last-Rev: 8f83d009ef0320fd3fe7cf03e55d5d24df57f015 GitHub-Pull-Request: golang/go#76448 Reviewed-on: https://go-review.googlesource.com/c/go/+/724220 Reviewed-by: Cherry Mui Reviewed-by: Ian Lance Taylor Auto-Submit: Ian Lance Taylor Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-on: https://go-review.googlesource.com/c/go/+/725341