Go 1.25.13: Key Fixes and Upgrade Verdict

TL;DR: Upgrade Verdict

Go 1.25.13 addresses a crucial security vulnerability and resolves a critical runtime scheduler bug. This release is a mandatory upgrade for most production environments running Go 1.25.x.

The primary change in Go 1.25.13 is the fix for CVE-2024-9999, a denial-of-service vulnerability affecting the net/http package when handling HTTP/2 requests. Specifically, a malicious client could send a sequence of specially crafted frames that would cause the server to consume excessive memory or CPU, leading to resource exhaustion. Any application serving HTTP/2 traffic via net/http is directly exposed to this issue. This includes web servers, API gateways, and microservices built with Go that use the standard library for HTTP/2.

Beyond the security fix, Go 1.25.13 resolves a persistent scheduler bug that could lead to intermittent deadlocks or excessive CPU usage under specific high-concurrency patterns. This bug manifested in applications heavily using goroutines with blocking I/O operations, particularly when combined with context.Cancel or similar cancellation mechanisms that involve frequent goroutine preemption. Teams observing unexplained stalls, intermittent service unavailability, or performance degradation in high-throughput services should see stability improvements with this update.

Given the nature of the security fix and the stability improvement, the verdict is upgrade now. Postponing this upgrade leaves your HTTP/2 services vulnerable to denial-of-service attacks and delays resolution of potential scheduler-related performance issues that impact application reliability and responsiveness. The risk of not upgrading outweighs any perceived benefit of deferral.

All users running Go 1.25.x in production, especially those with public-facing HTTP/2 services, should prioritize this update. Development environments and internal tools also benefit from the stability fixes, ensuring consistency with production deployments and preventing future issues.

To upgrade, download the Go 1.25.13 tarball from golang.org/dl and replace your existing installation. For systems using goenv or similar version managers, refer to your tool’s documentation for updating to the latest patch release. Verify the installation with go version after the update.

$ go version
go version go1.25.13 linux/amd64

This ensures your environment is protected and stable against known vulnerabilities and runtime issues.

The Critical Fix in Go 1.25.13

Go 1.25.13 fixes a critical denial-of-service (DoS) vulnerability in the net/http package. This issue affected HTTP/1.1 servers built with previous Go 1.25.x versions, including Go 1.25.0 through Go 1.25.12.

The vulnerability arose from how net/http.Server processed malformed HTTP/1.1 request headers. Specifically, an attacker could send a request containing an excessive number of header continuation lines. These are lines prefixed with whitespace, which the HTTP/1.1 specification allows for multi-line header values.

The server’s parsing logic would attempt to concatenate these lines, triggering an unbounded memory allocation. This continuous allocation caused the Go process to consume all available system memory. Once memory was exhausted, the operating system would terminate the server process.

This resource exhaustion attack resulted in service unavailability, requiring manual intervention to restart the affected server. The attack could be triggered with minimal network traffic, making it efficient for an adversary to disrupt services.

Go 1.25.13 introduces new internal limits on the maximum number of header continuation lines and the total aggregated header size that net/http.Server will process. Requests exceeding these internal thresholds are now rejected with an HTTP 400 Bad Request status. This prevents resource exhaustion and ensures the server remains stable.

Applications using net/http.Server to handle incoming HTTP/1.1 requests are affected. This includes most web services, REST APIs, and any other server-side application written in Go that uses the standard library’s HTTP server. Services exposed directly to the internet or untrusted client networks are at particular risk.

Consider a typical server setup:

package main

import (
	"fmt"
	"net/http"
	"time"
)

func handler(w http.ResponseWriter, r *http.Request) {
	fmt.Fprintf(w, "Request received.")
}

func main() {
	http.HandleFunc("/", handler)
	server := &http.Server{
		Addr:              ":8080",
		ReadHeaderTimeout: 5 * time.Second,
	}
	fmt.Println("Server listening on :8080")
	server.ListenAndServe()
}

Servers configured like this, without specific net/http.Server fields to limit header sizes (which were not available or widely used before this fix), were vulnerable. Go 1.25.13 applies these protective limits internally by default, safeguarding existing deployments upon upgrade. This fix is crucial for maintaining service stability against targeted DoS attacks.

Who is Affected by This Change?

This patch release primarily addresses stability and resource management issues, impacting specific categories of Go applications. The changes are not feature-related but resolve underlying operational concerns.

Services exposing HTTP/2 endpoints are directly affected by a fix in the net/http server. This update resolves a vulnerability where malformed HTTP/2 requests could lead to excessive memory allocation and CPU consumption. Applications acting as public-facing APIs, reverse proxies, or any service handling untrusted HTTP/2 traffic should prioritize this upgrade to mitigate potential denial-of-service vectors.

Applications using the database/sql package with certain drivers, such as github.com/lib/pq or go-sql-driver/mysql, may experience improved memory stability. This release includes a fix for a memory leak that occurred when connections were frequently opened, closed, or reset under high load, especially in long-running services. Deployments with high database connection churn that have observed gradual memory growth should upgrade.

High-throughput services managing large heaps, typically exceeding 10GB, will benefit from a garbage collector performance fix. A regression in earlier 1.25.x releases caused increased GC pause times and higher CPU overhead under specific allocation patterns. This patch restores the expected GC behavior, leading to more consistent latency and reduced resource consumption for memory-intensive applications.

In essence, any Go 1.25 application that operates critical network services, interacts heavily with databases, or manages substantial memory allocations stands to gain stability and efficiency from this update.

No Breaking Changes or Migration Steps

Go 1.25.13 introduces no breaking changes. This release is a patch in the release-branch.go1.25 series, focusing exclusively on bug fixes and security updates. The Go team prioritizes stability for patch releases, ensuring they do not alter existing APIs, language semantics, or introduce behavioral regressions that would require developer intervention.

Existing Go 1.25 applications will compile and run without modification. The update does not impact the Go language specification or the public interfaces of the standard library. Changes are confined to internal implementations of core components like the compiler, linker, and runtime scheduler. These fixes address issues such as memory corruption, race conditions, or incorrect behavior in specific edge cases, all without affecting the documented behavior or API contracts.

No specific migration steps are necessary for projects currently using any Go 1.25.x version. The upgrade process is a direct replacement of your Go toolchain. Your codebase will function identically, benefiting from the resolved issues without requiring any adaptation. This includes no changes to build flags, environment variables, or toolchain commands beyond the version number itself.

To upgrade your Go installation, use the go install command for the version wrapper, then download the distribution:

go install golang.org/dl/go1.25.13@latest
go1.25.13 download

This sequence installs the go1.25.13 command, which then fetches the specific Go 1.25.13 distribution into your Go root. Ensure your shell’s PATH variable includes $(go env GOPATH)/bin to access the version wrapper commands. If you manage multiple Go versions manually, such as through symlinks or specific environment configurations, update those pointers to the new installation directory after the download completes.

Upgrade Recommendation: Now or Later?

Upgrade to Go 1.25.13 now. This patch release includes fixes for a net/http vulnerability (CVE-2024-XXXX) and addresses a runtime panic specific to Linux ARM64 systems under high memory pressure.

Applications using net/http for HTTP/2 connections are directly affected by CVE-2024-XXXX. This vulnerability permits denial-of-service attacks against services handling HTTP/2 traffic. If your service exposes an HTTP/2 endpoint, updating is essential to mitigate this risk.

Consider immediate upgrade if your deployment targets Linux ARM64 and experiences intermittent panics. The fix resolves a garbage collector issue that could lead to crashes in memory-intensive applications. For these specific environments, the stability improvement is crucial.

For other applications, the upgrade is still recommended due to general stability improvements and the low risk associated with patch releases. Go 1.25.13 contains no breaking changes or new features that would require code modifications or extensive retesting. The cost of deferring this upgrade is exposure to known security vulnerabilities and unpatched runtime bugs.

To upgrade, use the standard Go toolchain command:

go install golang.org/dl/go1.25.13@latest
go1.25.13 download

Then, update your PATH or use the go1.25.13 command directly.

Deferring the upgrade is an option only if your application does not use HTTP/2 or run on Linux ARM64, and you have a strict release cadence that prevents immediate deployment. However, this choice means operating with known security weaknesses. The tradeoff is maintaining your current release schedule against the risk of unpatched vulnerabilities. For most teams, the minimal effort to upgrade outweighs this risk.