RHSA-2026:49702
Vulnerability from csaf_redhat - Published: 2026-08-03 16:04 - Updated: 2026-08-25 19:02Summary
Red Hat Security Advisory: golang security update
Severity
Important
Notes
Topic: An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)
* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)
* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)
* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)
* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.
5.9 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the 'go bug' command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.
4.4 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.
7.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.
5.4 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.
6.5 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.
5.4 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment.
5.3 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.
5.3 (Medium)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
120 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)\n\n* cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)\n\n* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n\n* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)\n\n* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)\n\n* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)\n\n* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)\n\n* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n\n* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:49702",
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "2467810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467810"
},
{
"category": "external",
"summary": "2467811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
},
{
"category": "external",
"summary": "2467813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467813"
},
{
"category": "external",
"summary": "2467815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
},
{
"category": "external",
"summary": "2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "2467823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
},
{
"category": "external",
"summary": "2467825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
},
{
"category": "external",
"summary": "2467826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
},
{
"category": "external",
"summary": "2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "2484205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484205"
},
{
"category": "external",
"summary": "2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49702.json"
}
],
"title": "Red Hat Security Advisory: golang security update",
"tracking": {
"current_release_date": "2026-08-25T19:02:47+00:00",
"generator": {
"date": "2026-08-25T19:02:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:49702",
"initial_release_date": "2026-08-03T16:04:08+00:00",
"revision_history": [
{
"date": "2026-08-03T16:04:08+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-03T16:04:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-25T19:02:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_0.aarch64",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_0.aarch64",
"product_id": "go-toolset-0:1.26.5-1.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_0.aarch64",
"product": {
"name": "golang-0:1.26.5-1.el10_0.aarch64",
"product_id": "golang-0:1.26.5-1.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_0.aarch64",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_0.aarch64",
"product_id": "golang-bin-0:1.26.5-1.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_0.aarch64",
"product": {
"name": "golang-race-0:1.26.5-1.el10_0.aarch64",
"product_id": "golang-race-0:1.26.5-1.el10_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_0.ppc64le",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_0.ppc64le",
"product_id": "go-toolset-0:1.26.5-1.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_0.ppc64le",
"product": {
"name": "golang-0:1.26.5-1.el10_0.ppc64le",
"product_id": "golang-0:1.26.5-1.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_0.ppc64le",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_0.ppc64le",
"product_id": "golang-bin-0:1.26.5-1.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_0.ppc64le",
"product": {
"name": "golang-race-0:1.26.5-1.el10_0.ppc64le",
"product_id": "golang-race-0:1.26.5-1.el10_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_0.s390x",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_0.s390x",
"product_id": "go-toolset-0:1.26.5-1.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_0.s390x",
"product": {
"name": "golang-0:1.26.5-1.el10_0.s390x",
"product_id": "golang-0:1.26.5-1.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_0.s390x",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_0.s390x",
"product_id": "golang-bin-0:1.26.5-1.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_0.s390x",
"product": {
"name": "golang-race-0:1.26.5-1.el10_0.s390x",
"product_id": "golang-race-0:1.26.5-1.el10_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.26.5-1.el10_0.x86_64",
"product": {
"name": "go-toolset-0:1.26.5-1.el10_0.x86_64",
"product_id": "go-toolset-0:1.26.5-1.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_0.x86_64",
"product": {
"name": "golang-0:1.26.5-1.el10_0.x86_64",
"product_id": "golang-0:1.26.5-1.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.26.5-1.el10_0.x86_64",
"product": {
"name": "golang-bin-0:1.26.5-1.el10_0.x86_64",
"product_id": "golang-bin-0:1.26.5-1.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el10_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.26.5-1.el10_0.x86_64",
"product": {
"name": "golang-race-0:1.26.5-1.el10_0.x86_64",
"product_id": "golang-race-0:1.26.5-1.el10_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el10_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-0:1.26.5-1.el10_0.src",
"product": {
"name": "golang-0:1.26.5-1.el10_0.src",
"product_id": "golang-0:1.26.5-1.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.26.5-1.el10_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-docs-0:1.26.5-1.el10_0.noarch",
"product": {
"name": "golang-docs-0:1.26.5-1.el10_0.noarch",
"product_id": "golang-docs-0:1.26.5-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.26.5-1.el10_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.26.5-1.el10_0.noarch",
"product": {
"name": "golang-misc-0:1.26.5-1.el10_0.noarch",
"product_id": "golang-misc-0:1.26.5-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.26.5-1.el10_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.26.5-1.el10_0.noarch",
"product": {
"name": "golang-src-0:1.26.5-1.el10_0.noarch",
"product_id": "golang-src-0:1.26.5-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.26.5-1.el10_0?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.26.5-1.el10_0.noarch",
"product": {
"name": "golang-tests-0:1.26.5-1.el10_0.noarch",
"product_id": "golang-tests-0:1.26.5-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.26.5-1.el10_0?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64"
},
"product_reference": "go-toolset-0:1.26.5-1.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64"
},
"product_reference": "golang-0:1.26.5-1.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le"
},
"product_reference": "golang-0:1.26.5-1.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x"
},
"product_reference": "golang-0:1.26.5-1.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src"
},
"product_reference": "golang-0:1.26.5-1.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64"
},
"product_reference": "golang-0:1.26.5-1.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64"
},
"product_reference": "golang-bin-0:1.26.5-1.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch"
},
"product_reference": "golang-docs-0:1.26.5-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch"
},
"product_reference": "golang-misc-0:1.26.5-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64"
},
"product_reference": "golang-race-0:1.26.5-1.el10_0.aarch64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le"
},
"product_reference": "golang-race-0:1.26.5-1.el10_0.ppc64le",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x"
},
"product_reference": "golang-race-0:1.26.5-1.el10_0.s390x",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.26.5-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64"
},
"product_reference": "golang-race-0:1.26.5-1.el10_0.x86_64",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch"
},
"product_reference": "golang-src-0:1.26.5-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.26.5-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
},
"product_reference": "golang-tests-0:1.26.5-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-33814",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:11.324941+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in the Go HTTP/2 protocol implementation allows a remote, unauthenticated attacker to exhaust system resources. By sending a specially crafted HTTP/2 SETTINGS frame with a zero-value SETTINGS_MAX_FRAME_SIZE, the vulnerable Go library enters an infinite loop, impacting the availability of services utilizing HTTP/2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "RHBZ#2467815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33814",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
},
{
"category": "external",
"summary": "https://go.dev/cl/761581",
"url": "https://go.dev/cl/761581"
},
{
"category": "external",
"summary": "https://go.dev/cl/761640",
"url": "https://go.dev/cl/761640"
},
{
"category": "external",
"summary": "https://go.dev/issue/78476",
"url": "https://go.dev/issue/78476"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4918",
"url": "https://pkg.go.dev/vuln/GO-2026-4918"
}
],
"release_date": "2026-05-07T19:41:17.631000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
},
{
"cve": "CVE-2026-39817",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-07T20:01:43.510043+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the \"go tool pack\" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the \"pack\" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39817"
},
{
"category": "external",
"summary": "RHBZ#2467825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
},
{
"category": "external",
"summary": "https://go.dev/cl/767520",
"url": "https://go.dev/cl/767520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78778",
"url": "https://go.dev/issue/78778"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4979",
"url": "https://pkg.go.dev/vuln/GO-2026-4979"
}
],
"release_date": "2026-05-07T19:41:18.993000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction"
},
{
"cve": "CVE-2026-39819",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-05-07T20:01:04.403877+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467813"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the \u0027go bug\u0027 command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system\u0027s temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the \u0027go bug\u0027 command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39819"
},
{
"category": "external",
"summary": "RHBZ#2467813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467813"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39819"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819"
},
{
"category": "external",
"summary": "https://go.dev/cl/763882",
"url": "https://go.dev/cl/763882"
},
{
"category": "external",
"summary": "https://go.dev/issue/78584",
"url": "https://go.dev/issue/78584"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4978",
"url": "https://pkg.go.dev/vuln/GO-2026-4978"
}
],
"release_date": "2026-05-07T19:41:18.849000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-07-08T17:01:53.592869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39822"
},
{
"category": "external",
"summary": "RHBZ#2498152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"category": "external",
"summary": "https://go.dev/cl/797880",
"url": "https://go.dev/cl/797880"
},
{
"category": "external",
"summary": "https://go.dev/issue/79005",
"url": "https://go.dev/issue/79005"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4970",
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"release_date": "2026-07-08T15:46:27.199000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
},
{
"cve": "CVE-2026-39823",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-07T20:00:58.284024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467811"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL\u0027s content attribute inside a `\u003cmeta\u003e` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship the Go `html/template` package as a dependency of various Go-based components. The affected functionality involves URL escaping inside `\u003cmeta\u003e` tag content attributes, which requires an application to render user-controlled URLs in meta tags using `html/template`. While the vulnerable code is present, exploitation requires a specific usage pattern that is uncommon in Red Hat product code paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39823"
},
{
"category": "external",
"summary": "RHBZ#2467811",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39823"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
},
{
"category": "external",
"summary": "https://go.dev/cl/769920",
"url": "https://go.dev/cl/769920"
},
{
"category": "external",
"summary": "https://go.dev/issue/78913",
"url": "https://go.dev/issue/78913"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4982",
"url": "https://pkg.go.dev/vuln/GO-2026-4982"
}
],
"release_date": "2026-05-07T19:41:19.524000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Ensure that user-supplied URLs are validated and sanitized before being passed to Go\u0027s `html/template` package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content"
},
{
"cve": "CVE-2026-39825",
"cwe": {
"id": "CWE-472",
"name": "External Control of Assumed-Immutable Web Parameter"
},
"discovery_date": "2026-05-07T20:01:37.714133+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Go\u0027s net/http/httputil package where ReverseProxy can forward query parameters that are hidden from Rewrite or Director functions. This occurs when the number of query parameters exceeds the url.ParseQuery limit (controlled by the GODEBUG setting urlmaxqueryparams). While Red Hat ships Go-based components across many products, exploitation requires that an application use ReverseProxy with a Rewrite or Director function that relies on query parameter inspection for security enforcement, which limits the practical impact of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39825"
},
{
"category": "external",
"summary": "RHBZ#2467823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39825",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39825"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
},
{
"category": "external",
"summary": "https://go.dev/cl/770541",
"url": "https://go.dev/cl/770541"
},
{
"category": "external",
"summary": "https://go.dev/issue/78948",
"url": "https://go.dev/issue/78948"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4976",
"url": "https://pkg.go.dev/vuln/GO-2026-4976"
}
],
"release_date": "2026-05-07T19:41:18.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy\u0027s Rewrite or Director function for security filtering.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls"
},
{
"cve": "CVE-2026-39826",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-07T20:01:46.305827+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467826"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only \u0027type\u0027 attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39826"
},
{
"category": "external",
"summary": "RHBZ#2467826",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39826",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39826"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
},
{
"category": "external",
"summary": "https://go.dev/cl/771180",
"url": "https://go.dev/cl/771180"
},
{
"category": "external",
"summary": "https://go.dev/issue/78981",
"url": "https://go.dev/issue/78981"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4980",
"url": "https://pkg.go.dev/vuln/GO-2026-4980"
}
],
"release_date": "2026-05-07T19:41:19.138000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42501",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-07T20:00:54.811489+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467810"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in the Go command (`cmd/go`) allows a malicious module proxy to bypass checksum validation, potentially leading to the execution of untrusted Go toolchains. Red Hat products utilizing the Go command are vulnerable if configured to use an untrusted module proxy or checksum database, as this could compromise the integrity of the Go development environment. Exploitation requires user interaction with a compromised proxy.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42501"
},
{
"category": "external",
"summary": "RHBZ#2467810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467810"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42501"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501"
},
{
"category": "external",
"summary": "https://go.dev/cl/775321",
"url": "https://go.dev/cl/775321"
},
{
"category": "external",
"summary": "https://go.dev/issue/79070",
"url": "https://go.dev/issue/79070"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4984",
"url": "https://pkg.go.dev/vuln/GO-2026-4984"
}
],
"release_date": "2026-05-07T19:41:19.691000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "To verify the integrity of Go module dependencies and detect potential tampering by a malicious proxy, users can revalidate all dependencies of the current module. This process involves removing the existing `go.sum` file and then re-generating and verifying module checksums.\n\nExecute the following commands in your module\u0027s root directory:\n```bash\nrm go.sum\ngo mod tidy\ngo mod verify\n```\nThis operation will re-download and re-verify all module dependencies. Be aware that this may affect your local module cache and could require re-building projects.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy"
},
{
"cve": "CVE-2026-42507",
"cwe": {
"id": "CWE-117",
"name": "Improper Output Neutralization for Logs"
},
"discovery_date": "2026-06-02T23:01:03.125126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484205"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42507"
},
{
"category": "external",
"summary": "RHBZ#2484205",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484205"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42507"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507"
},
{
"category": "external",
"summary": "https://go.dev/cl/777060",
"url": "https://go.dev/cl/777060"
},
{
"category": "external",
"summary": "https://go.dev/issue/79346",
"url": "https://go.dev/issue/79346"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5039",
"url": "https://pkg.go.dev/vuln/GO-2026-5039"
}
],
"release_date": "2026-06-02T22:01:37.307000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T16:04:08+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49702"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:go-toolset-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.src",
"AppStream-10.0.Z.E2S:golang-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-bin-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-docs-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-misc-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.aarch64",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.ppc64le",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.s390x",
"AppStream-10.0.Z.E2S:golang-race-0:1.26.5-1.el10_0.x86_64",
"AppStream-10.0.Z.E2S:golang-src-0:1.26.5-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:golang-tests-0:1.26.5-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…