golang

Related (declined) Go proposal: go#54297, with some variations and discussion of this pattern. Personally I prefer the simpler variant (mentioned in a sibling comment here already) that reads as testutil.Must(NewUsername("joe123")). The implementation in the OP separates the function and the argument, which I don't personally like.

go#69230 never thought I'd live to see the day

To preserve the order when processing JSON a workaround has been introduced: news.ycombinator.com Still searching the true solution: go#27179 A proposal of the missing datatype for this operation mode has been just accepted: go#69559

GoのCollectionがexpでAccepted！🎉 go#80590 https://hashed.Map[K,V] go#69559 hashed.Set[T] go#80584 set.Set go#69230

Those guys were the same that helped out with generics in Java, they even published a book in 2006, homepages.inf.ed.ac.uk Before Featherweight Go, there was Featherweight Java. So maybe a language designed in 2012 (v 1.0 release year), should learn from history instead of hand-waving it away as needless fluff. > In retrospect, we were biased too much by experience with C++ without concepts and Java generics. We would have been well-served to spend more time with CLU and C++ concepts earlier. github.com/golang/proposal/blob/master/design/go2… And not all on the team were convinced even after Featherweight Go, here Rob Pike, > I think the transition to getting polymorphism into the language through generics is has still got some years to work through there's still things that don't quite work right youtu.be

Generic collections accepted for Go 1.28, jsonv2 lands in 1.27 🐿️ GoDaily - November 5, 2026 The collections proposal is through: generic set, hashed map, and insertion-ordered map packages are accepted for Go 1.28, with recent updates covering JSON marshaling behaviour for the ordered map. Alongside that, the Go blog publishes the design writeup for the new encoding/json/v2 and encoding/json/jsontext packages shipping in 1.27, co-authored by Pratt, Tsai, Martí, Brandhorst-Satzkorn, Peppe, Hines, and Neil. Two long-running standard library stories converging in the same week is a reasonable excuse to finally read both. Accepted Proposals 6 collection/...: generic collection types Targeting Go 1.28 — Updates: including insertion-ordered maps, and specifying JSON marshaling behavior. 13 Oct 2026. -jba Updated with the latest changes. 7 Oct 2026. -jb Read on GitHub → golang.org/x/exp/collection/set: new package with a generic set type (Please see the pinned comment below for recent updates. 7 Oct 2026. --jba) (Please see go#69230 issuecomment-5095993 Read on GitHub → golang.org/x/exp/collection/hashed: Map, a generic hash table with custom hash function and equivalence relation (Latest draft at go#69559 issuecomment-5698574903. ) Oct 7 2026 --jba.) (Latest draft at golang/go Read on GitHub → go/doc: standardize deprecated comment tags Proposal Details Background Different Go tools already supports detecting "Deprecated:" strings in the doc comments for symbols (see go.dev Read on GitHub → golang.org/x/exp/collection/hashed: Set, a set based on a hash table that uses the element type's custom hash function and equivalence relation See pinned comment just below for updates. 7 Oct 2026. --jba -------- This is the hash.Set counterpart to: - 69559 Proposal: We propose to add the Set Read on GitHub → sync: add new type Counter, a sharded counter Prototype : go.dev/cl/743460 Abstract We propose adding a sharded Counter to the sync package. This type provides a scalabl Read on GitHub → Discussions 4 “A new Go API for JSON” by Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhor “A new Go API for JSON” by Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil — https:// go.dev/blog/jsonv2 golang Read on Mastodon → A new Go API for JSON Go 1.27 introduces new encoding/json/v2 and encoding/json/jsontext packages. Read on Lobsters → Go Backend Engineer, open to remote roles (full-time, part-time, or contract) Read on Golang Bridge → Introducing Hike: An alternative Go compiler implemented 100% in Go, for zero-runtime, tiny Wasm, and Cgo-free native libraries Read on Golang Bridge → Articles 5 How to Build Multi-Tenant SaaS Retrieval (Tracing PDF Citations Across 3 Stages) Short answer: choose a retrieval path only after defining freshness, tenant isolation, and citation... Read on Dev.to → Go vs Rust: The Real Reason Behind the Faster TypeScript Compiler Microsoft’s TypeScript compiler got about 10x faster in Go. The real story is compatibility, not benchmarks, and what it means for your… Continue reading on Medium » Read on Medium → Crossing the Language Barrier: nosqlite-ffi and the C ABI Series: nosqlite devlog, Part 5 Continue reading on Medium » Read on Medium → You’re Sound Asleep — Until OOM Sounds the Alarm Getting paged at 4 a.m. is bad enough. Discovering that the trouble started in a helper function you’ve scrolled past a hundred times… Continue reading on Medium » Read on Medium → Leader election without tears: Raft for working engineers You probably shouldn’t implement Raft. But you should understand it, because etcd, Consul and Kafka run on it, and leader election in your… Continue reading on Medium » Read on Medium → Videos 5 Facade Pattern #coding #golang A facade pattern hides ugly or complicated parts of a system and presents with a neat facade, hiding the implementation details. Read on YouTube → Golang Concurrency Will Finally Make Sense After This Go concurrency for beginners, proven with real programs: Ana's tea shop program checks three teas with a supplier one after ... Read on YouTube → TypeScript 7 Go Compiler: Why Errors Show Up So Much Sooner TypeScript 7 and its Go compiler: why does the red squiggle show up so much sooner? In the VS Code codebase, opening a file ... Read on YouTube → Go Language Day 1 | Introduction to Golang & Environment Setup | Vagdevi Technologies GO LANGUAGE TRAINING – DAY 1 | VAGDEVI TECHNOLOGIES Welcome to Go Programming Language Training at Vagdevi ... Read on YouTube → A Go Web API with Postgres in 60 Seconds ⚡ #golang #shorts Built-in routes, safe SQL, and a working API with a real database, in under a minute! Full Lesson 13 on our channel: ... Read on YouTube → Trending 1 mcpjungle/MCPJungle One place to manage & connect to all your MCP servers Read on GitHub Trending → Social 1 “A new Go API for JSON” by Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhor “A new Go API for JSON” by Michael Pratt, Joe Tsai, Daniel Martí, Johan Brandhorst-Satzkorn, Roger Peppe, Chris Hines, and Damien Neil — go.dev golang Read on Bluesky → Jobs 3 Bubblehouse | Fully REMOTE | Full-Time | $200–250k | Principal EngineerWe’re a small team across the US and Europe. We build the... platform that household-name brands use to run their own loyalty programs.We write Go and run our own database engine on top of local key-value stores. We keep storage and compute on the same dedicate Read on HN Who's Hiring → Lumen Labs | Robotics/Hardware Engineer, Simulation Engineer | San Francisco, CA | ONSITE | Full-time | $150k–200k + equity... lumenresearch.cohowdy! Lumen Labs is building the cognitive layer for physical AI. Nearly every major robotics effort today teaches machines by showing them thousands of hours of human teleope Read on HN Who's Hiring → SentiLink | sentilink.com | Engineering & Data Science | REMOTE, HYBRID, and ONSITE (UNITED STATES ONLY) | Full Time Primarily hiring in the U.S. for more senior level roles.We’re hiring across Engineering (Primarily Backend/Data Platform) and Data Science / ML roles. Hiring at Manager/Director level as well as Se Read on HN Who's Hiring → Enjoying this issue? Share it → LinkedInBlueskyX / Twitter

Go 1.27 Drains Unread Response Bodies for You. Past 256 KB, the Connection Still Dies - Book: The Complete Guide to Go Programming - Also by me: Pocket Guides for Developers — the 8-book series - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- 100 sequential status-only GETs to index.golang.org, forced onto HTTP/1 with GODEBUG=http2client=0, took about 710 ms on Go 1.26 and about 150 ms on Go 1.27 on the author's machine. That is the benchmark in the Go team's post Better HTTP/1 connection reuse, published 14 October 2026 by Nicholas Husin and Damien Neil. The program itself didn't change. The standard library started doing something Go developers had been told to do by hand for years. You know the habit. Every code review that touches an HTTP client eventually gets a comment asking for io.Copy(io.Discard, resp.Body) before resp.Body.Close(), so the connection goes back to the pool. Go 1.27 moved that into net/http.Transport. It also put limits on it, and the limits are where your connections still die. What Go 1.26 did with a body you didn't finish HTTP/1 sends responses back to back on one TCP connection. The client can't send the next request on that connection until it has consumed the current body to its end, as the Content-Length or Transfer-Encoding header defines it. If you closed the body early, Go 1.26 and earlier gave up on the connection and dialed a new one, with a fresh TCP handshake and, for HTTPS, a fresh TLS handshake. The blog post points out how easy this is to trigger by accident. A json.Decoder can stop reading right before the trailing newline of a JSON body. One unread byte, and the connection is gone. Go 1.27 changes Close. The release notes say HTTP/1 Response.Body "now automatically drains any unread content upon being closed, up to a conservative limit." The work was tracked in golang/go#77370, which spells the limit out: "up to a limit of 256k bytes, or 50 milliseconds, whichever one is reached first." HTTP/2 is not affected, because its streams are multiplexed and an unread body on one stream doesn't block the others. !A pipe carrying response bodies into a small drain grate, with oversized blocks bouncing off it Small, fast leftovers go down the drain. Anything bigger or slower takes the connection with it. The exact rule, from transport.go "256 KB" sounds like "the first 256 KB of whatever is left." It isn't. In transport.go on the 1.27 release branch, the decision to try a drain is one line: tryDrain := alive && resp.ContentLength <= maxPostCloseReadBytes maxPostCloseReadBytes is 256 << 10 and maxPostCloseReadTime is 50 * time.Millisecond. Four things follow from that code: 1. The check uses the declared Content-Length of the whole response, not the bytes you left unread. A 300 KB body is never drained, even if you read all but the last 100 bytes. 2. A response with no length (chunked) has ContentLength -1, so it passes the check. The drain then copies at most 256 KB + 1 byte in a goroutine and only keeps the connection if it hits EOF. 3. The drain gives up after 50 ms. A server that pauses mid-body costs you the connection. 4. If the request or the response says Connection: close, alive is already false and no drain runs. One more detail matters for measuring this. The read loop lets Close return before the drain starts. The related fix is tracked as CL 741222, "prevent blocking when draining response body after it has been closed," linked from the same issue. Your Close call doesn't wait. The drain happens behind it. A demo that counts connections from the server's side The cleanest way to see reuse is to count new connections where they arrive. http.Server.ConnState is called with StateNew once per accepted connection, and httptest keeps your hook when it wraps the server. The program below runs 100 GETs against a local server, reads -read bytes of each body, closes it, and prints how many connections the server accepted. package main import ( "flag" "fmt" "io" "net" "net/http" "net/http/httptest" "strconv" "strings" "sync/atomic" "time" ) func main() { size := flag.Int("size", 4<<10, "body size in bytes") read := flag.Int64("read", 0, "bytes the client reads") chunked := flag.Bool("chunked", false, "no Content-Length") stall := flag.Duration("stall", 0, "pause mid-body") flag.Parse() body := strings.Repeat("x", *size) half := *size / 2 h := func(w http.ResponseWriter, r *http.Request) { if !*chunked { w.Header().Set("Content-Length", strconv.Itoa(*size)) } if *chunked || *stall > 0 { w.(http.Flusher).Flush() } io.WriteString(w, body[:half]) if *stall > 0 { w.(http.Flusher).Flush() time.Sleep(*stall) } io.WriteString(w, body[half:]) } var newConns atomic.Int64 srv := httptest.NewUnstartedServer(http.HandlerFunc(h)) srv.Config.ConnState = func(c net.Conn, s http.ConnState) { if s == http.StateNew { newConns.Add(1) } } srv.Start() defer srv.Close() client := srv.Client() for i := 0; i < 100; i++ { resp, err := client.Get(srv.URL) if err != nil { panic(err) } io.CopyN(io.Discard, resp.Body, *read) resp.Body.Close() } fmt.Println("new connections:", newConns.Load()) } The Flush before the first write in chunked mode matters. The ResponseWriter.Write docs say the server adds Content-Length automatically when the output is under a few KB "and there are no Flush calls." Flushing first sends the headers without a length, so the body goes out chunked. Save it as main.go, then run it under both toolchains. If you have 1.27 installed, GOTOOLCHAIN=go1.26.0 go run main.go fetches and uses 1.26 for the comparison run. I haven't run these myself; the expectations below come straight from the code quoted above. go run main.go # 4 KB, read nothing go run main.go -size 300000 -read 299900 go run main.go -chunked -size 100000 go run main.go -chunked -size 400000 go run main.go -stall 100ms !A server icon tallying new connections on a chalkboard while a client fires a stream of requests Count connections where they're accepted, not where they're requested. What each run should show Run one, 4 KB with nothing read: on 1.26 every Close is early, so expect 100 new connections. On 1.27 the drain picks up the 4 KB and the connection goes back to the pool, so the count should drop to a small number. It may not be exactly 1. Because Close returns before the drain finishes, the next Get can find no idle connection and start a dial, and on loopback a dial is fast enough to win that race sometimes. Run two, 300,000 bytes with all but 100 read: declared length is over 262,144, so 1.27 never tries. Expect about 100 on both versions. This is the case where "it drains for you" is most misleading. Run three, chunked 100,000 bytes: ContentLength is -1, the drain reads the rest within 256 KB + 1 and hits EOF, so 1.27 should reuse. Run four, chunked 400,000 bytes: the drain copies 256 KB + 1 without reaching EOF and drops the connection. Back to about 100. Run five, a 100 ms pause mid-body: the 50 ms timer fires before the second half arrives. About 100 on both, and each server handler is still sleeping when the client hangs up. What to do with the drains already in your code If your module only builds with Go 1.27 or later, delete the io.Copy(io.Discard, resp.Body) lines and keep defer resp.Body.Close(). That follows the blog's advice to just close the body. An unbounded io.Copy was always a liability anyway: point it at a multi-gigabyte download you meant to abandon and it reads the whole thing on your goroutine. The release notes list no GODEBUG setting for this change, so the behavior comes with the 1.27 standard library. If you still support 1.26 or earlier, keep a drain but bound it. The blog's version caps bytes at 256 KB. The standard library copies 256<<10 + 1 bytes instead. If exactly 256 KB is left, a copy capped at 256 KB stops without reading EOF, and the transport only reuses a connection whose body reached EOF. The extra byte tells "exactly 256 KB" apart from "more". func drainAndClose(body io.ReadCloser) { io.CopyN(io.Discard, body, 256<<10+1) body.Close() } Run it as go drainAndClose(resp.Body) if you don't want the caller to wait on a slow peer. The blog also describes adding a timer that calls body.Close after 50 ms to interrupt the copy. For responses you know you'll abandon and that are large, a drain won't help on any version. Avoid fetching what you don't need: a HEAD request, a Range header, or a paginated endpoint. When you will read a status line and walk away from a big body, set req.Close = true. The transport sends Connection: close, skips the drain, and the server knows not to keep the connection open for you. The blog notes that for large bodies a new connection can be cheaper than draining, which is why the limits exist. For slow peers, the 50 ms drain timer protects connection reuse, not your own reads. Keep a Client.Timeout or a context deadline on the request. The one setup this can make slower The release notes call out a case that gets worse. Programs that were "improperly allowing an excessive amount of idle connections to linger," usually by setting Transport.MaxIdleConns to 0 or by using different Clients for different requests, may now see degradation, because connections that used to die early now survive into the idle pool. The fix they give is Transport.DisableKeepAlives = true if you truly don't want reuse. They add that this usually points to improper configuration or usage of Transport or Client in the first place, and that a deeper look would likely be beneficial. In practice, the common repair is sharing one Client instead of building a new one per request. --- If this was useful This change is a good example of why it pays to know what net/http does underneath Close: the rule lives in one line of transport.go, and it decides whether your client handshakes once or a hundred times. The Complete Guide to Go Programming is where I cover the standard library at that level, along with the runtime and the concurrency model that goroutine-based drains like this one sit on. 

Go "method must have no type parameters": causes and fixes Originally published on ImportStatic. Since Go 1.27, a method on a concrete type may declare its own type parameters. On a current setup, "method must have no type parameters" therefore means one of two things: an older toolchain or an older go line in go.mod is still in charge, or the method is in an interface, where type parameters remain forbidden. The exact wording of the message tells you which. We compiled this file, a small slice type with a generic Map method, under Go 1.25.13, 1.26.10 and 1.27.3 and collected every message: type List[T any] []T // Map has its own type parameter R: a generic method. func (l List[T]) Map[R any](f func(T) R) List[R] { out := make(List[R], 0, len(l)) for _, v := range l { out = append(out, f(v)) } return out } func main() { nums := List[int]{1, 2, 3} fmt.Printf("%q\n", nums.Map(strconv.Itoa)) } With Go 1.27.3 and go 1.27 in go.mod, go vet is silent and go run . prints ["1" "2" "3"]. Every other combination fails with one of these messages. What each message means | You see | What compiled the file | Fix | |---|---|---| | syntax error: method must have no type parameters | A Go 1.26 or older compiler | Build with Go 1.27 or newer | | generic method requires go1.27 or later (-lang was set to go1.26; check go.mod) | Go 1.27, but go.mod says go 1.26 | go get go@1.27.3 | | go: go.mod requires go >= 1.27 (running go 1.26.10; GOTOOLCHAIN=go1.26.10) | An older go command that isn't allowed to switch | Install Go 1.27, or drop the pinned GOTOOLCHAIN | | package requires newer Go version go1.27 (application built with go1.25) plus undefined: R | An editor or linter built with an older Go | Reinstall the tool with Go 1.27 | | interface method must have no type parameters | Any version, Go 1.27 included | Move the type parameter to the interface | The compiler is older than Go 1.27 Before 1.27 a method couldn't have type parameters at all, so Go 1.26.10 rejects the file at parse time: # example.com/generic126 ./main.go:11:21: syntax error: method must have no type parameters go vet from the same toolchain reports it without the "syntax error" prefix, as vet: ./main.go:11:21: method must have no type parameters. An older compiler usually gets there through the go line. Our module had go 1.26, and the machine's default go is 1.25.13. Under the default GOTOOLCHAIN=auto, the toolchain rules say that when the go line is newer than the bundled toolchain, the go command runs that version instead, downloading it if needed. So go build fetched a Go 1.26 toolchain on its own and printed the syntax error above, even though no one had installed Go 1.26 on purpose. Go 1.27 is installed, but go.mod says 1.26 Under Go 1.27.3 the same module gets a different message: # example.com/generic126 ./main.go:11:22: generic method requires go1.27 or later (-lang was set to go1.26; check go.mod) Generic methods are gated on the language version as well as the toolchain. Raise the go line; go get does that and switches toolchains for you: $ go get go@1.27.3 go: updating go.mod requires go >= 1.27.3; switching to go1.27.3 go: upgraded go 1.26 => 1.27.3 After that, go run . printed ["1" "2" "3"]. In a library this has a cost. The toolchain docs define the go line as the minimum Go version for using the module, so one generic method in a public package moves every importer to 1.27. If you can't ask that of your users yet, use one of the rewrites further down. The reverse case is a newer go line meeting an older go command that isn't allowed to switch. With GOTOOLCHAIN=local on Go 1.25.13: go: go.mod requires go >= 1.27 (running go 1.25.13; GOTOOLCHAIN=local) GOTOOLCHAIN=local is usually set in CI images and Docker builds. Move those to a Go 1.27 image rather than lowering the go line. Errors from editors and linters If go build succeeds and your editor still underlines the method, look at the tool behind the editor. A program that analyses Go code with the standard go/parser and go/types packages uses the versions of those packages it was compiled with. The Go on your PATH plays no part. We wrote a short checker that parses and type-checks one file with those two packages, and built it with each toolchain. Built with Go 1.25.13 and told the file is Go 1.27, it printed: go/parser: main.go:11:21: method must have no type parameters go/types: main.go:1:1: package requires newer Go version go1.27 (application built with go1.25) go/types: main.go:11:39: undefined: R go/types: main.go:11:47: undefined: R go/types: main.go:12:19: undefined: R The undefined: R lines follow from the parser error. The Go 1.25 parser parses method type parameters only "for a better error message and improved error recovery", reports them, and then throws them away, so the type checker sees R used with no declaration. If your editor shows a pile of "undefined" errors on type parameter names, look for the "application built with" line. It names the Go the tool was compiled with, and go/types adds it exactly when the code asks for a newer version than that. Built with Go 1.26.10, the checker's output was identical apart from "go1.26". Built with Go 1.27.3, it reported nothing, so reinstalling the tool with a Go 1.27 toolchain (for gopls, go install golang.org/x/tools/gopls@latest) clears the errors. The go/types source also has the wording "methods cannot have type parameters", in signature.go, but it only fires when a syntax tree arrives with method type parameters still attached. Since go/parser drops them first, none of our runs printed it. Interface methods still can't have type parameters The Go 1.27 release notes say interface methods may not declare type parameters, and Go 1.27.3 rejects this: type Mapper interface { Map[R any](f func(int) R) []R } ./main.go:4:5: interface method must have no type parameters ./main.go:4:25: undefined: R Changing the go line or the toolchain won't help here. The Go blog post on generic methods gives the reason: a value in an interface can be of any dynamic type, so the compiler would need code for the method with every possible type argument. A generic method on a concrete type can't satisfy an ordinary interface either; our Go generic methods article shows the "wrong type for method" error you get. Two rewrites that compile on Go 1.26 When you can't move to 1.27, or the method has to sit behind an interface, two shapes have worked since Go 1.18: a package-level generic function, or the type parameter on the interface itself. type List[T any] []T // Fix 1: a package-level generic function instead of a generic method. func Map[T, R any](l List[T], f func(T) R) List[R] { out := make(List[R], 0, len(l)) for _, v := range l { out = append(out, f(v)) } return out } // Fix 2: the type parameter moves from the method to the interface. type Mapper[R any] interface { Map(f func(int) R) []R } type Ints []int func (s Ints) Map(f func(int) string) []string { out := make([]string, 0, len(s)) for _, v := range s { out = append(out, f(v)) } return out } func main() { fmt.Printf("%q\n", Map(List[int]{1, 2, 3}, strconv.Itoa)) var m Mapper[string] = Ints{4, 5} fmt.Printf("%q\n", m.Map(strconv.Itoa)) } With go 1.26 in go.mod, go vet passed on Go 1.26.10 and the program printed ["1" "2" "3"] and ["4" "5"] on both 1.26.10 and 1.27.3. The function form reads inside-out, Map(list, f) instead of list.Map(f). The interface form fixes R per interface instantiation, so Ints satisfies Mapper[string] and nothing else. A single value that can map to any result type chosen at the call site needs Go 1.27's generic methods, which exist only on concrete types. If you're on 1.27 already, the upgrade notes we collected list what else moves when you raise the go line. --- Originally published on ImportStatic. This article was drafted with AI assistance; every claim was checked against the sources linked in it and the code samples were compiled and run.

ポートが1つ開いてるだけで乗っ取られる？ VPSを守る基本 先に、3行で 2026年10月に公開されたLinuxカーネル（OSの中心にあたる部分）の脆弱性 CVE-2026-98432 は、外から届くTCP接続の受付処理にある。条件がそろうと、認証なしでroot権限（サーバーを何でも操作できる、いちばん強い管理者の権限）のコマンド実行に至る実証まで公表された。 対策の本筋は、修正済みカーネルへの更新と再起動。そのうえで、インターネットに開いた窓口（ポート）を減らすと、狙われる入口そのものが小さくなる。 SSHはTailscaleの中だけ、WebはCloudflare Tunnel経由にすると、公開の受信ポートをなくせる。ただし、アプリの脆弱性やアカウントの乗っ取りまでは防げない。 Xで流れてきた「1つのポートで乗っ取り」 2026年11月、Xで次のような投稿が広がりました。 levelsioさんは「だからVPSのポートは全部閉じておくべきと言った」「SSHはTailscaleの中だけ、WebはCloudflare Tunnelで受ける」と書き、「インターネットにTCPポートが1つ開いているだけで、どんなLinuxマシンも乗っ取られうる」と続けました。応急処置としてMPTCPの無効化にも触れています。levelsioさんの投稿 Mike Kiprutoさんは、CVE-2026-98432 について、認証なしでrootとしてコマンドを実行されうる、CVSS（脆弱性の深刻さを0〜10で表す点数）は9.8、MPTCP関連の緩和策は一時的なもの、と紹介しました。Mike Kiprutoさんの投稿 tamosanさんは、piyologのまとめ記事を紹介しています。tamosanさんの投稿、piyolog：CVE-2026-98432 についてまとめてみた 強い言葉が並ぶときほど、一次資料で確かめます。 公式情報で確認できたこと 項目 内容（出典） 何の問題か IPv4のTCP接続を受け付ける処理で、解放済みのメモリを使ってしまうuse-after-free。CVEレコード きっかけ 認証なしの相手が、IPv4のオプション（Record RouteまたはTimestamp）付きの接続要求（SYN）を、接続を待ち受けているサーバーへ送る。CVEレコード 深刻度 LinuxカーネルのCVE採番機関（CNA）の評価はCVSS 3.1で9.8（Critical）。Linuxカーネル CVEチームの告知 影響範囲 4.4以降のLinuxカーネル。修正版は 5.10.272、5.15.223、6.1.190、6.6.159、6.12.113、6.18.56、7.2.10、7.3（確認日時点。10月15日の最初の告知では 6.12.113、6.18.56、7.2.10、7.3 の4系列で、ほかはあとから追加）。同告知 IPv6 主な経路（1つ目の問題）はIPv6には影響しない、と説明されている。CVEレコード 実証 報告したAnthropicは、MPTCP（マルチパスTCP）の待ち受けがあるLinuxサーバーに対し、認証なしでrootとして任意のコマンドを実行する実証を公表。PoC（実証用の攻撃コード）では、カーネルの位置情報の漏えいに48分、そこからコマンド実行まで5分。Anthropic（2026年10月27日） CNAの記述そのものは、カーネルのメモリ内容の漏えい、境界外への書き込みと制御の乗っ取りの可能性、カーネル停止を挙げています。「rootでのコマンド実行」は、AnthropicがMPTCPの待ち受けがある条件で実証したことです。 Go言語のセキュリティチームは、次の2点を案内しています。いちばんの対策は修正済みカーネルへの更新だ、とも書いています。Go Security Team（oss-security経由） Go 1.24以降は、Linuxで待ち受けにMPTCPを既定で使うこと。 「バグ自体はMPTCP専用ではなく、MPTCPがなくても似た攻撃が成り立つ可能性がある」こと。 正確には、MPTCPが既定で有効になるのは、go.modのGoバージョンが1.24以上のプログラムの、待ち受け側だけです。カーネル側でMPTCPが使えない場合（net.mptcp.enabled=0。AlmaLinuxは既定でこの状態）は、普通のTCPで待ち受けます。Go：GODEBUG、Goのソースコード：mptcpsock_linux.go、Linuxカーネル：MPTCP Sysfs variables、AlmaLinuxブログ 評価や対応状況は、配布元ごとに違う 同じCVEでも、配布元（ディストリビューション）によって評価や修正の出方が違います。確認日時点の例です。 Debian：bookworm（security）の 6.1.190-1、trixie（security）の 6.12.113-1 などで修正済み。Debian Security Tracker Ubuntu：優先度High。26.10、26.04 LTS、24.04 LTS、22.04 LTSの標準カーネルは「Vulnerable（修正作業中）」の表示でした。Ubuntu CVEページ Red Hat：Critical、CVSS 9.8と評価し、2026年11月1日（UTC。日本時間では11月2日早朝）にRHEL 8/9/10向けの修正カーネルを公開しました（RHSA-2026:93412〜93415）。Red Hat CVEページ 修正前の緩和手順（IPオプション付きのTCPを、Linuxのファイアウォール機能であるnftablesで落とす）はセキュリティ速報 RHSB-2026-016 にありますが、Red Hat自身が「パッチの代わりにはならない」「カーネルの更新だけが完全な解決策」としています。Red Hat：RHSB-2026-016 AlmaLinux：8・9・10向けの修正カーネルをテスト用リポジトリで公開。再起動できない間の一時策として、IPv4オプション付きTCPを落とすnftablesの設定を示しています。AlmaLinuxブログ（2026年10月30日） piyologの10月30日時点のまとめでは、Red Hatの評価はImportant、8.1でした。piyolog 評価や修正の状況は数日で変わります。公開の前に、自分の使う配布元のページを見直してください。 Xの言い方と、確認できたことの差 「どんなLinuxマシンも、TCPポート1つで乗っ取られる」は、公式資料より強い言い方です。levelsioさんが引用していた元の投稿には「MPTCPが有効なら」という条件がありましたが、引用した側の文ではその条件が落ちています。確認できたのは、①修正前のカーネルで、②IPv4のTCPで待ち受けている、という条件で攻撃が届きうること。そして③rootでの実行は、MPTCPの待ち受けがある条件で実証されたことです。 それでも「インターネットからTCPの待ち受けに届くこと」が攻撃の入口だという点は、公式の説明と一致しています。ここから、ポートの話に進みます。 ポートは「建物の受付窓口」 サーバーを、大きな建物だと考えます。住所にあたるのがIPアドレス、建物の中の受付窓口にあたるのがポート（番号つきの通信の受け口）です。Webなら443番、SSH（サーバーを遠隔操作するための接続）なら22番、のように窓口が分かれています。 窓口が開いていて、係（プログラム）が座っている状態を「待ち受け（listen）」と呼びます。外から来た人は、開いている窓口にだけ話しかけられます。 たとえには限界があります。 実際の建物なら、窓口の前に立つ前に受付の人が顔を見ます。今回の脆弱性は、係が話を聞き始める前、建物の入口の仕組み（カーネル）で起きます。アプリにログイン機能があっても、その手前で問題が起きるのです。 窓口の番号を22から別の数字に変えても、窓口が開いていることは変わりません。番号を変えるのは「看板を外す」くらいの効果で、閉じたことにはなりません。 窓口を減らすと、なぜ安全になる？ 外から話しかけられる窓口が多いほど、攻撃者が試せる入口が増え、どこか1つに見落としがあれば、そこから入られます。 この「攻撃者が触れられる場所の広さ」を、攻撃対象領域（アタックサーフェス）と呼びます。使っていない窓口を閉じれば、その窓口の係やカーネルの受付処理に未知の問題があっても、外からは届きにくくなります。 今回のCVEに当てはめると、こうなります。ここからは公式資料ではなく、私の推論です。 インターネットから届くTCPの待ち受けがなければ、攻撃者は問題の処理を起こすための接続要求を、直接そのサーバーへ送りにくくなる。 ただし、同じネットワークの中の機械や、同じサーバー上のコンテナからは届きうる。参考までに、AlmaLinuxは自社が出した一時策のnftablesルールについて、同じホスト上のコンテナ間の通信では効かない場合があると注意しています（oss-securityでも紹介）。AlmaLinuxブログ、oss-security（2026年10月31日） だから、窓口を閉じるのは更新の代わりではなく、更新が終わるまでの時間と、まだ知られていない問題に備える守りです。 SSHはTailscaleの中だけ、WebはCloudflare Tunnel経由にすると levelsioさんが勧めていた構成を、公式ドキュメントで確かめます。 SSH：Tailscaleの中からだけ入る Tailscaleは、自分の端末どうしを暗号化された専用のネットワーク（tailnet）でつなぐサービスです。 公式ガイドは、サーバーへの接続をTailscale経由だけ受け付け、それ以外のインターネットからの通信は無視するのが一番よい、と説明しています。手順は、ufw（Ubuntuで通信の通す・通さないを決める、ファイアウォールの設定ツール）で受信を既定で拒否し、tailscale0 からの受信だけを許可し、22番の許可を消すというものです。Tailscale：ufwでUbuntuサーバーを守る Tailscaleは、ほとんどの場合ファイアウォールのポートを開ける必要がない、と説明しています。NAT（ルーターなどが行うアドレスの付け替え）を越える工夫で端末どうしをつなぎ、直接つながらない場合は中継サーバー（DERP）を使います。Tailscale：開けるべきポート Web：Cloudflare Tunnel経由で受ける Cloudflare Tunnelは、サーバー側の cloudflared というプログラムが、Cloudflareへ外向きの接続だけを張る仕組みです。 公開されたIPアドレスへ通信を受ける必要がなく、ファイアウォールでは外向きの接続だけを許可し、受信はすべて拒否できる、と説明されています。Cloudflare Tunnel 必要なのは、Cloudflareの7844番ポートへの外向き通信（TCPとUDP）です。トンネルの設定に書いたサービスだけが外に見える、とも書かれています。Cloudflare：Tunnel with firewall 建物にたとえると、表の窓口をすべて閉め、職員が自分から外の配達センターへ電話をつないでおく形です。お客さんの用件は配達センター経由で届き、建物の前に直接立つ人はいなくなります。 何が変わる？ 変更前 変更後 SSH インターネットから22番に届く tailnetの端末からだけ届く Web 80・443番に誰でも直接届く Cloudflareを経由した通信だけがアプリに届く 公開の受信ポート あり なし（ファイアウォールで受信を既定で拒否） 今回のCVEで考えると、インターネットの攻撃者が、VPSのTCPの待ち受けへ接続要求を直接送る道がなくなります。Webの接続を最初に受けるのはCloudflare側になるからです。ただし、これは私の推論で、TailscaleやCloudflareがこのCVEへの効果として説明しているものではありません。 それでも守れないもの 窓口を閉じても、次のものは残ります。 アプリの脆弱性：Cloudflare Tunnel経由でも、Webアプリには外からの要求が届きます。SQLインジェクション（第1回）やXSS（第2回）のような問題は、そのまま狙われます。 TailscaleやCloudflareのアカウント：Tailscaleは、ログインに使うID提供元でMFA（第22回）を有効にし、アクセス制御で最小権限にすることを勧めています。Tailscale：tailnetを守るベストプラクティス Cloudflareのダッシュボードで管理するトンネル（リモート管理トンネル）のトークンは、持っている人なら誰でもそのトンネルを動かせます。Cloudflare：Tunnel permissions 鍵の管理は第14・15回と同じ考え方です。 tailnetの中の端末：手元のパソコンが乗っ取られれば、そこからtailnet経由でサーバーに届きうる、と私は考えています（推論）。Tailscaleも、アクセス制御で「誰がどこへ接続できるか」を最小限に絞ることを勧めています。Tailscale：Define access control policies 外向きの通信：Cloudflareの手順は「外向きは許可、受信は拒否」です。サーバーが外へ通信できること自体は残るので、侵入されたあとの外部への送信は、この構成だけでは止まりません。 設定の抜け道：Dockerでコンテナのポートを公開すると、通信がufwの設定より前に振り分けられ、ufwの設定が実質的に無視される、とDockerの公式ドキュメントにあります。Docker：Packet filtering and firewalls カーネルの修正そのもの：古いカーネルが動いている状態は変わりません。 初心者向けチェックリスト ここに書くコマンドは、公式ドキュメントにある例です。筆者は実行・動作確認をしていません。 SSHの設定やファイアウォールを変えると、自分も締め出されることがあります。VPS事業者の管理画面のコンソールなど、別の入り方を確保してから、自分が管理するサーバーで試してください。 1. いま開いている窓口を見る 未実行・未検証：TCPで待ち受けているポートと、そのプログラムを表示する sudo ss -tlnp -t はTCP、-l は待ち受け中のもの、-n は名前に変換せず番号で、-p はプロセスを表示するオプションです。ss(8) 0.0.0.0 や [::] で待ち受けているものは、すべての通信の口から受けている可能性があります。一つずつ「これは何のための窓口？」と説明できるか確かめます。 2. ファイアウォールを「既定で拒否」にする 未実行・未検証：ufwの状態と既定の方針を確認する sudo ufw status verbose Ubuntuのufwは、初期状態では無効です。Ubuntu Server：Firewalls Tailscaleのガイドは、受信を既定で拒否（default deny incoming）、送信を既定で許可にしてから、必要な許可だけを残す手順です。Tailscale：ufwの手順 nftablesを直接使っている場合は、sudo nft list ruleset で設定を確認できます。 VPS事業者の管理画面にファイアウォール機能があれば、そちらでも受信を絞れます。Cloudflareのドキュメントも、クラウドのVMなら事業者側のファイアウォールで受信を全部拒否する方法を挙げています。Cloudflare：Cloud VM firewall 3. 更新を止めない。カーネルは再起動まで含める 未実行・未検証：いま動いているカーネルのバージョンを表示する uname -r Ubuntuでは unattended-upgrades が既定で入っていて、セキュリティ更新を1日1回自動で適用します。ただし、更新を完全に反映するのに再起動が必要な場合があり、自動再起動の設定（Automatic-Reboot）は既定で無効です。Ubuntu Server：Automatic updates つまり、新しいカーネルが入っていても、再起動するまでは古いカーネルが動き続けます。uname -r の結果を、配布元が示す修正版と比べてください。 配布元がまだ修正版を出していない場合は、その配布元の案内に従います。この記事で紹介したMPTCPの無効化やIPオプション付きSYNの遮断は、配布元や専門家が「一時的なもの」として示した例で、修正の代わりではありません。 4. SSHは鍵で入る OpenSSHでは、パスワード認証（PasswordAuthentication）も公開鍵認証（PubkeyAuthentication）も、既定で「許可」です。sshd_config(5) 鍵でログインできることを確かめてから、パスワード認証を無効にします。鍵の秘密の側は、自分の端末から出しません。 チェック表 ss -tlnp で見えた待ち受けを、すべて説明できる。 ファイアウォールが「受信は既定で拒否」になっている。 Dockerなどで、ファイアウォールを迂回するポート公開をしていない。 uname -r が、配布元の示す修正済みカーネルになっている（再起動済み）。 セキュリティ更新が自動で入り、再起動の予定を決めている。 SSHは公開鍵でログインし、パスワード認証を無効にした。 Tailscale・Cloudflareのアカウントに、MFAを設定した。 よくある勘違い 「ポートを閉じたから、更新しなくていい」 → 閉じるのは入口を小さくする工夫です。カーネルの修正と再起動が本筋です。 「Cloudflare Tunnelなら、アプリが安全になる」 → 届く経路が変わるだけで、アプリへの要求は届きます。 「SSHのポート番号を変えれば閉じたのと同じ」 → 窓口は開いたままです。 「Xで9.8と言っていたから9.8」 → CNAは9.8ですが、配布元の評価は時期によって違いました。自分の配布元のページを見ます。 窓口を減らし、残った窓口の係（アプリ）と建物の土台（カーネル）を最新に保つ。どれか1つではなく、重ねて守ることが大切です。 参考にした一次資料 一次資料（公式発表・公開メーリングリスト） CVE Program：CVE-2026-98432 NVD：CVE-2026-98432 Linuxカーネル CVEチーム：CVE-2026-98432 の告知（mbox） linux-cve-announce：最初の告知（2026年10月15日） Linuxカーネル：修正コミット e3f33b0a1d89 Debian Security Tracker：CVE-2026-98432 Ubuntu：CVE-2026-98432 Red Hat：CVE-2026-98432・RHSB-2026-016 AlmaLinux：CVE-2026-98432: Patched kernels available in testing（2026年10月30日） Anthropic：Discovering and exploiting vulnerabilities in critical, real-world software with Claude（2026年10月27日） oss-security：Go Security Teamの案内（2026年10月30日）・MPTCPの無効化についての返信・追加の緩和策についての投稿（2026年10月31日） Tailscale：Use ufw to lock down an Ubuntu server・What firewall ports should I open・Best practices to secure your tailnet Cloudflare：Cloudflare Tunnel・Tunnel with firewall・Tunnel permissions Go：GODEBUG（multipathtcp）・mptcpsock_linux.go Linuxカーネル：MPTCP Sysfs variables Ubuntu Server：Automatic updates・Firewalls Docker：Packet filtering and firewalls ss(8)・sshd_config(5) 二次資料・話題のきっかけ piyolog：Linuxカーネルの脆弱性 CVE-2026-98432 についてまとめてみた（2026年10月30日） levelsioさんの投稿・Mike Kiprutoさんの投稿・tamosanさんの投稿 2026年11月2日 10時45分ごろ（日本時間）の時点で、JPCERT/CCの注意喚起、IPAの重要なセキュリティ情報、JVNのVU一覧に本件は見当たりませんでした（JVN iPediaは一時停止中のため未確認）。 公式資料確認日：2026-11-02（Red Hat・Ubuntu・JPCERT/CC・IPA・JVNは同日10時台に再確認） この記事は学習用の説明です。コマンドの実行や、実サーバーでの設定変更・動作試験は行っていません。「推論」と書いた部分は、公式資料に直接の記述がない筆者の考えです。

Go 1.24+ Servers Ask Linux for MPTCP: the Precondition for Claude's Root Exploit - Book: System Design Pocket Guide: Fundamentals - Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- If your Go service runs on Linux and its main module targets Go 1.24 or later, it asks the kernel for a multipath TCP (MPTCP) listener. Anthropic wrote on October 27 that Claude, "after initial prompting," built a remote root exploit for "Linux servers with a multipath TCP listener." Two days later the Go Security Team sent golang-announce a note on protecting Go programs against CVE-2026-98432 (archived on oss-security). Its message for Go developers: unless you told it not to, a Go 1.24+ server requests exactly that kind of listener. The Go docs say that since Go 1.24 the multipathtcp setting "defaults to multipathtcp="2", thus enabled by default on listeners." You probably never chose that. What changed since Anthropic's post Anthropic's October 27 post described the bug as "a race condition-induced UAF bug in the kernel networking stack" and said it took the model's exploit "48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution." The model is "an unreleased, internal research model," and Anthropic has not published the exploit. The Go team's October 29 announcement tied the exploit's precondition to Go's default and listed mitigations. On October 30, Red Hat published RHSB-2026-016 and rated the flaw Critical for RHEL 8, 9 and 10 and OpenShift. It lists no fixed kernels yet and says Red Hat "is expediting the release of fixes." The distributions have split. Debian has fixed kernels for bookworm and trixie. Ubuntu's tracker, last updated October 30, still lists the linux package as vulnerable on every release from 16.04 to 26.10, with work in progress on 22.04, 24.04, 26.04 and 26.10. The CVE itself is older. Ubuntu lists it as published on October 15 with a CVSS 3 score of 9.8, and Debian's tracker describes IP options being freed while another CPU still reads them during the IPv4 TCP handshake. Why a Go server meets the precondition Go 1.21 added Multipath TCP, but only when an application asked for it. Go 1.24 changed the default to multipathtcp=2: MPTCP on for listeners, off for dialers. Every net.Listen("tcp", ...) and every http.ListenAndServe in a program whose main module declares go 1.24 or later (in go.mod or go.work) requests an MPTCP socket from the kernel, unless a godebug setting says otherwise. The toolchain version alone doesn't decide it. Per the GODEBUG docs, a newer toolchain building a module that still says go 1.23 keeps the old opt-in behavior. Whether the kernel hands one back depends on the host. The kernel switch is net.mptcp.enabled. TuxCare, which sells KernelCare, a live kernel patching service, says Enterprise Linux 8, 9 and 10 ship with MPTCP disabled, so a Go service on a stock RHEL host falls back to plain TCP. Don't assume. Check each host: # 1 means the kernel will create MPTCP sockets sysctl net.mptcp.enabled # listening MPTCP sockets and the process that owns each sudo ss -Mlnp If the second command lists your Go binaries, they meet the precondition Anthropic described. The Go team is careful about what that means. Its announcement says the bug is not specific to MPTCP, and a Go maintainer said the same on the proposal issue. Per Debian's tracker, the root cause is a use-after-free in Linux's IPv4 TCP handling. Turning MPTCP off removes the one path that has been demonstrated. Nobody has said it is the only path. !Flat vector illustration of a two-lane road merging into a single open gate at the base of a server tower, one lane drawn in burnt orange A Go 1.24+ server asks the kernel for MPTCP on its listeners. The kernel decides whether that lane is open. Patch first. The Go switches are a stopgap The Go team calls a patched kernel "the best fix." Debian's fixed builds are 6.12.113-1 for trixie and 6.1.190-1 for bookworm, per its tracker. A new kernel package only protects you after a reboot. Until then, the announcement lists three ways to keep a Go program on plain TCP. The quickest needs no rebuild. Set it in the service's environment and restart: GODEBUG=multipathtcp=0 ./server If GODEBUG already holds settings, add this one with a comma. To bake it into the binary, put it in the main module's go.mod: module example.com/server go 1.24 godebug multipathtcp=0 Two catches from the GODEBUG docs. Only the main module's go.mod counts, so a library can't set this for you. And when you build inside a workspace, go.mod godebug lines are ignored and go.work is read instead. The third switch is per listener. ListenConfig.SetMultipathTCP overrides the GODEBUG value for that one socket: package main import ( "context" "log" "net" "net/http" ) func main() { var lc net.ListenConfig lc.SetMultipathTCP(false) // plain TCP, whatever GODEBUG says ctx := context.Background() ln, err := lc.Listen(ctx, "tcp", ":8080") if err != nil { log.Fatal(err) } log.Fatal(http.Serve(ln, http.NotFoundHandler())) } The Go team's own verdict on all three is "a fragile mitigation." One forgotten MPTCP listener on the host, in any language, keeps the precondition alive, and the approach assumes every working exploit needs MPTCP. Red Hat's interim nftables rule, which drops inbound IPv4 TCP packets carrying IP options, has the same limit: Red Hat says it "cannot fully prevent it." !Flat vector illustration of three small toggle switches flipped off on a control panel, beside a much larger wrench tightening a bolt on a server chassis GODEBUG covers a process, go.mod covers a binary, SetMultipathTCP covers one listener. Should Go flip the default back? A proposal to disable MPTCP by default was opened on October 29 and is still open. Maintainers disagree. One Go maintainer wrote that changing the default now would be "closing the barn door after the horse has left," and asked for a justification of the current default, noting Go seems unusual in having one. Another Go team member wrote: "I don't see any reason that a security issue should lead us to disable it." A Linux kernel MPTCP developer joined to argue for MPTCP's benefits, such as moving a connection between networks without dropping it, and to say listener-side MPTCP has no performance cost for plain TCP clients. The Go team's announcement calls a default change "premature" for now. Some projects aren't waiting. The Lightning Network daemon lnd merged a change on October 30 that, in an lnd developer's words, "makes plain TCP the default for newly built lnd binaries." The same developer told operators that "Disabling MPTCP removes the prerequisite for the demonstrated exploit," and that they "should still install a patched kernel as soon as one is available." What to do this week 1. Run sudo ss -Mlnp on every Linux host that faces the internet. Note which processes hold MPTCP listeners. 2. Check your distribution's tracker for a fixed kernel: Debian, Ubuntu, Red Hat. Install it and plan the reboot. 3. Check the go line in each service's go.mod (or go.work). At go 1.24 or later, assume the service requests MPTCP unless a godebug setting turns it off. 4. Where no fixed kernel exists yet, set GODEBUG=multipathtcp=0 on Go services and restart them. Add godebug multipathtcp=0 to go.mod if you don't use MPTCP on purpose. 5. Look at which kernel completes the TCP handshake with outside clients. If a proxy terminates TCP in front of your Go service, that proxy's host is the one an outside peer reaches first, so patch it first. --- If this was useful The fix for this one is a kernel update and a reboot on every exposed host, and the hard part is doing that across a fleet without dropping traffic. Draining a node behind a load balancer, rolling it, and bringing it back is the kind of building block the System Design Pocket Guide: Fundamentals walks through. I also build Hermes IDE, a free, source-available desktop app (macOS, Windows, Linux) that runs Claude Code, Codex and other coding agents side by side, and each one can work on its own branch; star it on GitHub if that sounds useful.