tag: Go · 6 items
- Engineer — Act: Any Go service built before 1.27.3/1.26.10 may break TLS connections to hosts whose certificates chain through the blocked CA keys — or vice versa. Upgrade Go to 1.27.3 or 1.26.10 and run integration tests against your outbound TLS dependencies before deploying, to catch breakage before production.
- SOC/IR — Learn: No exploitation angle and no IOCs to hunt; however, awareness helps analysts triage a spike in TLS handshake failures in application logs that may follow this Go rollout across the ecosystem.
- Leader — Skip
- Engineer — Learn: Go’s http.Client follows redirects and carries caller-set headers by default, which can leak API keys to unintended origins; this library enforces a drop-on-origin-change policy worth evaluating if your Go services make outbound API calls with sensitive headers.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Go’s default http.Client forwards all headers through redirects, potentially leaking API keys to unintended origins; this library demonstrates the fix pattern worth evaluating for any Go service that follows redirects with bearer tokens or API keys.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Addresses a real credential-leak risk: Go’s default http.Client follows redirects with all headers intact, which can expose tokens like X-Api-Key to unintended origins. Evaluate this library if your Go services make authenticated outbound HTTP requests that may follow redirects.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Go’s default http.Client forwards all caller-set headers (including API keys and auth tokens) through cross-origin redirects — this library demonstrates the risk pattern and a mitigation worth evaluating for any Go service making outbound HTTP calls with sensitive headers.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: If your Go codebase depends on github.com/cloudflare/circl and uses the FourQ elliptic curve (key exchange or signatures), audit that usage and schedule an upgrade; EPSS is 0.00 and no KEV listing, but a public PoC exists and cryptographic correctness flaws can enable key-recovery or signature-forgery scenarios.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2025-8556 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub