Vulnerability-Lookup

RHSA-2026:37435

Vulnerability from csaf_redhat - Published: 2026-07-09 20:07 - Updated: 2026-07-10 16:54

Summary

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:RHEL-193476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-39821

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-39822

A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch	—	Vendor Fix fix Workaround

Threats

Impact Important

References

22 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:37435	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://bugzilla.redhat.com/show_bug.cgi?id=2498152	external
https://issues.redhat.com/browse/RHEL-193476	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-39821	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://www.cve.org/CVERecord?id=CVE-2026-39821	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39821	external
https://go.dev/cl/767220	external
https://go.dev/issue/78760	external
https://groups.google.com/g/golang-announce/c/iI-…	external
https://pkg.go.dev/vuln/GO-2026-5026	external
https://access.redhat.com/security/cve/CVE-2026-39822	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498152	external
https://www.cve.org/CVERecord?id=CVE-2026-39822	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39822	external
https://go.dev/cl/797880	external
https://go.dev/issue/79005	external
https://groups.google.com/g/golang-announce/c/Orm…	external
https://pkg.go.dev/vuln/GO-2026-4970	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)\n\nBug Fix(es) and Enhancement(s):\n\n* Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:RHEL-193476)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:37435",
        "url": "https://access.redhat.com/errata/RHSA-2026:37435"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2498152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
      },
      {
        "category": "external",
        "summary": "RHEL-193476",
        "url": "https://issues.redhat.com/browse/RHEL-193476"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37435.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-10T16:54:35+00:00",
      "generator": {
        "date": "2026-07-10T16:54:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:37435",
      "initial_release_date": "2026-07-09T20:07:34+00:00",
      "revision_history": [
        {
          "date": "2026-07-09T20:07:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-09T20:07:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-10T16:54:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_8.aarch64",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_8.aarch64",
                  "product_id": "go-toolset-0:1.26.5-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_8.aarch64",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_8.aarch64",
                  "product_id": "golang-0:1.26.5-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_8.aarch64",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_8.aarch64",
                  "product_id": "golang-bin-0:1.26.5-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_8.aarch64",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_8.aarch64",
                  "product_id": "golang-race-0:1.26.5-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
                  "product_id": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_8.ppc64le",
                  "product_id": "golang-0:1.26.5-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
                  "product_id": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_8.ppc64le",
                  "product_id": "golang-race-0:1.26.5-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_8.x86_64",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_8.x86_64",
                  "product_id": "go-toolset-0:1.26.5-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_8.x86_64",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_8.x86_64",
                  "product_id": "golang-0:1.26.5-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_8.x86_64",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_8.x86_64",
                  "product_id": "golang-bin-0:1.26.5-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_8.x86_64",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_8.x86_64",
                  "product_id": "golang-race-0:1.26.5-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_8.s390x",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_8.s390x",
                  "product_id": "go-toolset-0:1.26.5-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_8.s390x",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_8.s390x",
                  "product_id": "golang-0:1.26.5-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_8.s390x",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_8.s390x",
                  "product_id": "golang-bin-0:1.26.5-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_8.s390x",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_8.s390x",
                  "product_id": "golang-race-0:1.26.5-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_8.src",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_8.src",
                  "product_id": "golang-0:1.26.5-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.26.5-1.el9_8.noarch",
                "product": {
                  "name": "golang-docs-0:1.26.5-1.el9_8.noarch",
                  "product_id": "golang-docs-0:1.26.5-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.26.5-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.26.5-1.el9_8.noarch",
                "product": {
                  "name": "golang-misc-0:1.26.5-1.el9_8.noarch",
                  "product_id": "golang-misc-0:1.26.5-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.26.5-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.26.5-1.el9_8.noarch",
                "product": {
                  "name": "golang-src-0:1.26.5-1.el9_8.noarch",
                  "product_id": "golang-src-0:1.26.5-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.26.5-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.26.5-1.el9_8.noarch",
                "product": {
                  "name": "golang-tests-0:1.26.5-1.el9_8.noarch",
                  "product_id": "golang-tests-0:1.26.5-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.26.5-1.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64"
        },
        "product_reference": "golang-0:1.26.5-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le"
        },
        "product_reference": "golang-0:1.26.5-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x"
        },
        "product_reference": "golang-0:1.26.5-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src"
        },
        "product_reference": "golang-0:1.26.5-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64"
        },
        "product_reference": "golang-0:1.26.5-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch"
        },
        "product_reference": "golang-docs-0:1.26.5-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch"
        },
        "product_reference": "golang-misc-0:1.26.5-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch"
        },
        "product_reference": "golang-src-0:1.26.5-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.26.5-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
        },
        "product_reference": "golang-tests-0:1.26.5-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-09T20:07:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:37435"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-39822",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-07-08T17:01:53.592869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/797880",
          "url": "https://go.dev/cl/797880"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79005",
          "url": "https://go.dev/issue/79005"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4970",
          "url": "https://pkg.go.dev/vuln/GO-2026-4970"
        }
      ],
      "release_date": "2026-07-08T15:46:27.199000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-09T20:07:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:37435"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.5-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.5-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.5-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "os: golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    }
  ]
}

CVE-2026-39821 (GCVE-0-2026-39821)

Vulnerability from cvelistv5 – Published: 2026-05-22 15:01 – Updated: 2026-07-10 12:05

Title

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Summary

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Assigner

References

47 references

URL	Tags
https://go.dev/cl/767220
https://go.dev/issue/78760
https://groups.google.com/g/golang-announce/c/iI-…
https://pkg.go.dev/vuln/GO-2026-5026
https://access.redhat.com/security/cve/CVE-2026-39821	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:34789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35827	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35826	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34357	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30853	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35830	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35831	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30854	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35828	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35829	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34359	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36808	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34364	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30651	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26547	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36207	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26546	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36651	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23264	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36648	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35994	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35993	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33155	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33163	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33173	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33183	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33160	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37387	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36105	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36167	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30650	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36883	vendor-advisoryx_refsource_REDHAT

Impacted products

89 products

Vendor	Product	Version
golang.org/x/net	golang.org/x/net/idna	Affected: 0 , < 0.55.0 (semver)
Red Hat	Red Hat OpenShift Container Platform 4.22	cpe:/a:redhat:openshift:4.22::el8 cpe:/a:redhat:openshift:4.22::el9
Red Hat	RHEM 1.0 for RHEL 9	cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	Red Hat Enterprise Linux AppStream (v. 10)	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux AppStream (v. 8)	cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux AppStream (v. 9)	cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Cluster Observability Operator 1.5.0	cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	DevWorkspace Operator 0.42	cpe:/a:redhat:devworkspace:0.42::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.4	cpe:/a:redhat:logging:6.4::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.13	cpe:/a:redhat:acm:2.13::el9
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	cpe:/a:redhat:advanced_cluster_security:4.10::el8
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.11	cpe:/a:redhat:advanced_cluster_security:4.11::el9
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.9	cpe:/a:redhat:advanced_cluster_security:4.9::el8
Red Hat	Red Hat Edge Manager 1.0	cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	Red Hat Enterprise Linux AI 3.4	cpe:/a:redhat:enterprise_linux_ai:3.4::el9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift Builds 1.7.4	cpe:/a:redhat:openshift_builds:1.7::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift GitOps 1.19	cpe:/a:redhat:openshift_gitops:1.19::el8
Red Hat	Red Hat OpenShift GitOps 1.20	cpe:/a:redhat:openshift_gitops:1.20::el9
Red Hat	Red Hat OpenShift Service Mesh 2.6	cpe:/a:redhat:service_mesh:2.6::el8
Red Hat	Red Hat OpenShift Service Mesh 3.1	cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat Openshift Data Foundation 4.22	cpe:/a:redhat:openshift_data_foundation:4.22::el9
Red Hat	Red Hat Trusted Artifact Signer 1.4	cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	multicluster engine for Kubernetes 2.6	cpe:/a:redhat:multicluster_engine:2.6::el8
Red Hat	multicluster engine for Kubernetes 2.8	cpe:/a:redhat:multicluster_engine:2.8::el9
Red Hat	multicluster engine for Kubernetes 2.9	cpe:/a:redhat:multicluster_engine:2.9::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	cert-manager Operator for Red Hat OpenShift	cpe:/a:redhat:cert_manager:1
Red Hat	Compliance Operator	cpe:/a:redhat:openshift_compliance_operator:1
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Deployment Validation Operator	cpe:/a:redhat:deployment_validator_operator
Red Hat	External Secrets Operator for Red Hat OpenShift	cpe:/a:redhat:external_secrets_operator:1
Red Hat	Fence Agents Remediation Operator	cpe:/a:redhat:workload_availability_far:0
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Machine Deletion Remediation Operator	cpe:/a:redhat:workload_availability_mdr:0
Red Hat	Migration Toolkit for Applications 8	cpe:/a:redhat:migration_toolkit_applications:8
Red Hat	Migration Toolkit for Containers	cpe:/a:redhat:rhmt:1
Red Hat	Multiarch Tuning Operator	cpe:/a:redhat:multiarch_tuning_operator
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Global Hub	cpe:/a:redhat:multicluster_globalhub
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	Node HealthCheck Operator	cpe:/a:redhat:workload_availability_nhc:0
Red Hat	OpenShift API for Data Protection	cpe:/a:redhat:openshift_api_data_protection:1
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat 3scale API Management Platform 2	cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 8	cpe:/a:redhat:ceph_storage:8
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat Developer Hub	cpe:/a:redhat:rhdh:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Lightspeed for Runtimes Operator	cpe:/a:redhat:lightspeed_for_runtimes:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift on AWS	cpe:/a:redhat:openshift_service_on_aws:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Web Terminal	cpe:/a:redhat:webterminal:1
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	streams for Apache Kafka 3	cpe:/a:redhat:amq_streams:3
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Service Interconnect 1	cpe:/a:redhat:service_interconnect:1
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2

Credits

KC1zs4 (https://github.com/KC1zs4)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-23T03:55:58.522682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1289",
                "description": "CWE-1289 Improper Validation of Unsafe Equivalence in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T13:13:15.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el8",
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "product": "RHEM 1.0 for RHEL 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 10)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 8)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9::appstream"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AppStream (v. 9)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:devworkspace:0.42::el9"
            ],
            "defaultStatus": "affected",
            "product": "DevWorkspace Operator 0.42",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:logging:6.4::el9"
            ],
            "defaultStatus": "affected",
            "product": "Logging Subsystem for Red Hat OpenShift 6.4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:acm:2.13::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.11::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.11",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Edge Manager 1.0",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AI 3.4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_builds:1.7::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Builds 1.7.4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.19::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift GitOps 1.19",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1.20::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift GitOps 1.20",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:2.6::el8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 2.6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.22::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Openshift Data Foundation 4.22",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.6::el8"
            ],
            "defaultStatus": "affected",
            "product": "multicluster engine for Kubernetes 2.6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.8::el9"
            ],
            "defaultStatus": "affected",
            "product": "multicluster engine for Kubernetes 2.8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.9::el9"
            ],
            "defaultStatus": "affected",
            "product": "multicluster engine for Kubernetes 2.9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:cert_manager:1"
            ],
            "defaultStatus": "affected",
            "product": "cert-manager Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_compliance_operator:1"
            ],
            "defaultStatus": "affected",
            "product": "Compliance Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:deployment_validator_operator"
            ],
            "defaultStatus": "affected",
            "product": "Deployment Validation Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1"
            ],
            "defaultStatus": "affected",
            "product": "External Secrets Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0"
            ],
            "defaultStatus": "affected",
            "product": "Fence Agents Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "affected",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "affected",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0"
            ],
            "defaultStatus": "affected",
            "product": "Machine Deletion Remediation Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8"
            ],
            "defaultStatus": "affected",
            "product": "Migration Toolkit for Applications 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhmt:1"
            ],
            "defaultStatus": "affected",
            "product": "Migration Toolkit for Containers",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multiarch_tuning_operator"
            ],
            "defaultStatus": "affected",
            "product": "Multiarch Tuning Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "affected",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0"
            ],
            "defaultStatus": "affected",
            "product": "Node HealthCheck Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift API for Data Protection",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "affected",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ceph_storage:8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ceph Storage 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:certifications:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:connectivity_link:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Connectivity Link 1",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:rhdh:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Developer Hub",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Lightspeed for Runtimes Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_service_on_aws:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift on AWS",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:webterminal:1"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Web Terminal",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "affected",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_interconnect:1"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Service Interconnect 1",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-22T15:01:21.462Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1289",
                "description": "Improper Validation of Unsafe Equivalence in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T12:05:36.478Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
          },
          {
            "name": "RHBZ#2480756",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30855"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35827"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35826"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34357"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30853"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35830"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35831"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30854"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35828"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35829"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34359"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34342"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34364"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30651"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26547"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36207"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26546"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36651"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33524"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23264"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36648"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35994"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35993"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33155"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33163"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33173"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33183"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33160"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37387"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36105"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36167"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30650"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36883"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:34789: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30855: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35827: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35826: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34357: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30853: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35830: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35831: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30854: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35828: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35829: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34359: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36808: DevWorkspace Operator 0.42"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30651: Red Hat Advanced Cluster Management for Kubernetes 2.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26547: Red Hat Advanced Cluster Security for Kubernetes 4.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36207: Red Hat Advanced Cluster Security for Kubernetes 4.11"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26546: Red Hat Advanced Cluster Security for Kubernetes 4.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36651: Red Hat Edge Manager 1.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33531: Red Hat Enterprise Linux AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33524: Red Hat Enterprise Linux AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23262: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23264: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36648: Red Hat OpenShift Builds 1.7.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35994: Red Hat OpenShift GitOps 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35993: Red Hat OpenShift GitOps 1.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33155: Red Hat OpenShift Service Mesh 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33163: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33173: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33183: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33160: Red Hat OpenShift Service Mesh 3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36105: multicluster engine for Kubernetes 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36167: multicluster engine for Kubernetes 2.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30650: multicluster engine for Kubernetes 2.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36883: multicluster engine for Kubernetes 2.9"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-22T16:00:52.844Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-22T15:01:21.462Z",
            "value": "Made public."
          }
        ],
        "title": "golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
        "workarounds": [
          {
            "lang": "en",
            "value": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/idna",
          "product": "golang.org/x/net/idna",
          "programRoutines": [
            {
              "name": "Profile.process"
            },
            {
              "name": "Profile.ToASCII"
            },
            {
              "name": "Profile.ToUnicode"
            },
            {
              "name": "ToASCII"
            },
            {
              "name": "ToUnicode"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.55.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "KC1zs4 (https://github.com/KC1zs4)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T15:01:21.462Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/767220"
        },
        {
          "url": "https://go.dev/issue/78760"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "title": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-39821",
    "datePublished": "2026-05-22T15:01:21.462Z",
    "dateReserved": "2026-04-07T18:13:03.526Z",
    "dateUpdated": "2026-07-10T12:05:36.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39822 (GCVE-0-2026-39822)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:46 – Updated: 2026-07-08 19:39

Title

Root escape via symlink plus trailing slash in os

Summary

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

References

4 references

URL	Tags
https://go.dev/issue/79005
https://groups.google.com/g/golang-announce/c/Orm…
https://go.dev/cl/797880
https://pkg.go.dev/vuln/GO-2026-4970

Impacted products

1 product

Vendor	Product	Version
Go standard library	os	Affected: 0 , < 1.25.12 (semver) Affected: 1.26.0-0 , < 1.26.5 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.2 (semver)

Credits

Mundur (https://github.com/M0nd0R)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T18:06:16.360721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-61",
                "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T19:39:17.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "os",
          "product": "os",
          "programRoutines": [
            {
              "name": "rootOpenFileNolog"
            },
            {
              "name": "openRootInRoot"
            },
            {
              "name": "OpenInRoot"
            },
            {
              "name": "Root.Create"
            },
            {
              "name": "Root.Open"
            },
            {
              "name": "Root.OpenFile"
            },
            {
              "name": "Root.OpenRoot"
            },
            {
              "name": "Root.ReadFile"
            },
            {
              "name": "Root.WriteFile"
            },
            {
              "name": "rootFS.Open"
            },
            {
              "name": "rootFS.ReadDir"
            },
            {
              "name": "rootFS.ReadFile"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.5",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mundur (https://github.com/M0nd0R)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, \u0027root.Open(\"symlink/\")\u0027 will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:46:27.199Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79005"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "url": "https://go.dev/cl/797880"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4970"
        }
      ],
      "title": "Root escape via symlink plus trailing slash in os"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-39822",
    "datePublished": "2026-07-08T15:46:27.199Z",
    "dateReserved": "2026-04-07T18:13:03.527Z",
    "dateUpdated": "2026-07-08T19:39:17.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:37435

CVE-2026-39821 (GCVE-0-2026-39821)

CVE-2026-39822 (GCVE-0-2026-39822)

Tags

Sightings

Nomenclature