Ubuntu notice USN-8900-1: flaws in Go Networking across HTTP/2, HTML parsing and IDNA

What happened and what to do

The notice USN-8900-1, published by Ubuntu Security on 7 October 2026, describes eight vulnerabilities in the Go Networking package. The issues affect error handling after GOAWAY frames in HTTP/2, quadratic-complexity decoding of HPACK headers, HTML parsing that can exhaust resources or enter an infinite loop, rendering of text nodes outside the HTML namespace that enables XSS, incorrect handling of tags in foreign content, and acceptance of Punycode labels that decode only to ASCII during internationalized domain processing. The identifiers are CVE-2022-27664, CVE-2022-41723, CVE-2023-3978, CVE-2024-45338, CVE-2025-22872, CVE-2025-47911, CVE-2025-58190 and CVE-2026-39821. The stated impacts range from denial of service to cross-site scripting and bypass of access controls.

In practice, a company should first identify which services, gateways, proxies and internal applications use Go with the affected networking and HTML parsing packages, including third-party components. It then needs to apply the updates provided by the distribution, restart the services and verify the running version. Because some risks are resource exhaustion, it is worth setting time, body size and header limits, and monitoring CPU and memory on endpoints that receive HTML or HTTP/2 traffic. For the access control risk with internationalized names, teams should review domain-based rules and test Punycode inputs against their filters. A test pipeline with malformed inputs can reproduce the cases before and after the fix.

How the consultancy can help

Diagnosis of the inventory of Go services exposed to these packages, prioritization by external exposure, an update plan with regression tests, and monitoring of resource consumption and running versions in production, deployed on the client's infrastructure.

Next step

If your company runs Go services or depends on networking and HTML parsing components, send a short description of your environment and what you need assessed. We will reply with a scoped proposal for diagnosis and implementation.