Go 1.26.5

Overview

Go 1.26.5 has been released on July 7, 2026, as a minor point release in the Go 1.26 series. This release is primarily focused on security hardening and bug fixes, addressing issues in the core compiler, runtime, standard library, and toolchain. All Go 1.26 users are encouraged to upgrade.

Security Fixes

Two security fixes are included in this release:

• crypto/tls — A vulnerability in TLS handshake handling has been resolved. Connections using certain cipher suites could, under specific conditions, leak sensitive data during the handshake. This fix closes a potential information disclosure vector in TLS 1.2 and 1.3 implementations.
• os — A file permission handling issue has been patched. On Unix systems, temporary file creation in specific edge cases could result in incorrect permission bits.

Bug Fixes

The following components received bug fixes in Go 1.26.5:

Compiler

• Fixed a rare compilation crash when inlining functions with complex generic type parameters.
• Resolved an issue where the compiler would incorrectly optimize away bounds checks in certain loop patterns.

Runtime

• Fixed a goroutine scheduling issue that could cause deadlocks under heavy contention on systems with more than 64 logical CPUs.
• Resolved a memory accounting discrepancy in the garbage collector that caused inaccurate MemStats reporting.

Go Command

• Fixed a bug where go test -count=1 would incorrectly cache test results when environment variables changed.
• Resolved an issue with module path resolution in workspaces containing multiple modules with overlapping dependencies.

Standard Library

• net: Fixed a race condition in HTTP/2 connection pooling that could cause connection leaks under high concurrency.
• os: Resolved a file descriptor leak in os.OpenFile when opening files with the O_CREATE flag on Windows.
• syscall: Fixed incorrect error handling for mmap on ARM64 Linux systems.

How to Upgrade

To upgrade to Go 1.26.5, download the appropriate binary from the official download page or use your system's package manager:

go install golang.org/dl/go1.26.5@latest
go1.26.5 download

Alternatively, download the tarball directly from https://go.dev/dl/.

Compatibility

Go 1.26.5 maintains backward compatibility with Go 1.26.x. No breaking changes or deprecations are introduced in this release. The minimum supported operating systems and architectures remain unchanged.

For the full list of fixed issues, refer to the Go 1.26.5 milestone on the issue tracker.