Go standard library CVE-2026-39822

Vendor-released patch: upgrade the Go toolchain to 1.25.12, 1.26.5, or 1.27.0-rc.2 (or later) and rebuild affected applications, since the fix ships in the standard library (fix commit https://go.dev/cl/797880, tracking issue https://go.dev/issue/79005, advisory https://pkg.go.dev/vuln/GO-2026-4970). Because the flaw is compiled into the binary, you must redeploy rebuilt binaries - patching only the host Go install does not fix already-built services. If immediate recompilation is not possible, a targeted workaround is to normalize and reject caller-supplied paths ending in a trailing slash before passing them to os.Root operations, and add an explicit lstat/symlink check on the final component rather than relying on os.Root as the sole sandbox; the trade-off is added path-handling code and possible breakage of legitimate directory-style ('dir/') paths. Additional advisories: oss-security https://seclists.org/oss-sec/2026/q3/102 and https://vuldb.com/vuln/376920.