Go 1.27 Release Candidate 2 Patches Symlink and TLS Privacy Flaws While Adding Generic Methods
Go 1.27's second release candidate fixes an os.Root symlink escape and a crypto/tls Encrypted Client Hello privacy leak, alongside the language's first generic methods.
Editor's Note ·
- Correction:
- The article quotes the golang-announce RC2 post as saying the root cause was "openat(fd, path, O_NOFOLLOW) follows symlinks when the path ends in /, which the Root implementation failed to account for." The source's actual wording is two sentences: "On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks in path when path ends in a /. Root failed to account for this behavior, permitting paths with a trailing / to escape." The underlying fact is accurately conveyed; the quotation is a paraphrase, not verbatim.
- Correction:
- The article quotes the golang-announce RC2 post describing the ECH leak as "allowing network observers to de-anonymize the hostname of the server, even when ECH was being used." The source's actual wording is "allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used." The underlying fact is accurately conveyed; the quotation shortens "a passive network observer who can collect handshakes" to "network observers."
Overview
The Go team shipped go1.27rc2, the second release candidate for Go 1.27, on July 7, 2026, bundling two security fixes with the language’s first implementation of generic methods, according to the golang-announce mailing list. The draft Go 1.27 release notes state that “Go 1.27 is not yet released. These are work-in-progress release notes. Go 1.27 is expected to be released in August 2026.” The first release candidate, go1.27rc1, went out on June 18, 2026, with the team asking developers to “try your production load tests and unit tests with the new version,” signed “Dmitri and Cherry for the Go team.”
Two Security Fixes
The RC2 announcement was flagged “[security]” and covers two vulnerabilities. The first, CVE-2026-39822, affects the os.Root sandboxing API on Unix systems. According to the official Go vulnerability database, “opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of a path is a symbolic link and the path ends in /.” The GitHub issue gives a concrete example: “root.Open(“symlink/”) would open “symlink” even when “symlink” is a symbolic link pointing outside of the root.” The root cause, per the golang-announce post, is that on Unix, “openat(fd, path, O_NOFOLLOW) follows symlinks when the path ends in /, which the Root implementation failed to account for.” The flaw was reported by Mundur (GitHub handle M0nd0R), credited in both the golang-announce email and the vulnerability database entry. The vulnerability database lists affected versions as before go1.25.12, from go1.26.0-0 before go1.26.5, and from go1.27.0-0 before go1.27.0-rc.2.
The second fix, CVE-2026-42505, targets crypto/tls’s Encrypted Client Hello (ECH) implementation. The vulnerability database describes it plainly: “Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.” The golang-announce post describes the leak as “allowing network observers to de-anonymize the hostname of the server, even when ECH was being used.” This issue was reported by Coia Prant (GitHub handle rbqvq), credited identically in the security email and the vulnerability database, which lists the same three affected-version ranges as the os.Root flaw. Developers testing the release candidate can install it with go install golang.org/dl/go1.27rc2@latest, per the announcement.
Generic Methods Arrive
Alongside the fixes, go1.27rc2 carries the first working implementation of generic methods, a change previously reported when the Go team accepted the proposal in March 2026. The release notes now describe the shipped feature: “Go 1.27 now supports generic methods: a method declaration may declare its own type parameters. This widely anticipated change allows adding generic functions within the namespace of a particular data type where before one had to declare such functions with a scope of the entire package.” The same notes preserve the limitation flagged during the proposal stage: “methods of interfaces may not declare type parameters nor can interface methods be implemented by generic methods.”
Other Additions in the Draft Release Notes
The draft release notes list several other additions. A new crypto/mldsa package “implements the post-quantum ML-DSA signature scheme specified in FIPS 204.” The standard library also gains encoding/json/v2, described as “a major revision of encoding/json” that provides Marshal, MarshalWrite, MarshalEncode, Unmarshal, UnmarshalRead, and UnmarshalDecode functions accepting variadic Options arguments, alongside a companion encoding/json/jsontext package for lower-level token-based JSON processing. A new uuid package “generates and parses UUIDs,” and an experimental simd package provides “portable and vector-size-agnostic SIMD support,” enabled by setting GOEXPERIMENT=simd at build time.
Goroutine leak profiling, which was experimental in Go 1.26, is now generally available through a goroutineleak profile type in runtime/pprof. The compiler also picks up a performance change: it “now generates calls to size-specialized memory allocation routines, reducing the cost of some small (<80 byte) memory allocations by up to 30%,” though the release notes caveat that “the overall improvement is expected to be ~1% in real allocation-heavy programs.” Separately, Go 1.27 raises its macOS baseline, requiring “macOS 13 Ventura or later,” with support for earlier versions discontinued.
What We Don’t Know
The release notes remain in draft form and the Go team has not published a fixed general-availability date beyond “expected to be released in August 2026.” It is not yet public whether additional release candidates will follow go1.27rc2 before the stable build ships.