Go 1.27.4 and 1.26.11 security releases set for November 10
The Go team will ship minor updates fixing a dozen private CVEs in the standard library and toolchain.
The Go team plans to release Go 1.27.4 and Go 1.26.11 during US business hours on Tuesday, November 10, with private security fixes spanning the standard library and the toolchain.
The updates address twelve CVEs: CVE-2026-97033 through CVE-2026-97043, plus CVE-2026-97054. Details remain private until the releases land, in line with the project's security policy. Michael and Cherry issued the pre-announcement for the Go team so operators can schedule upgrades once binaries are available.
Anyone running supported Go toolchains should treat the November 10 drops as mandatory security maintenance rather than routine point releases.