RHSA-2026:61253

Vulnerability from csaf_redhat - Published: 2026-08-31 04:11 - Updated: 2026-09-26 21:11
Summary
Red Hat Security Advisory: golang security update
Severity
Important
Notes
Topic: An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-27137

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-27145

A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-33810

A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-33811

A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-33814

A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-39817

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.

5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-39819

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the 'go bug' command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.

4.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-39820

A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-39821

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.

8.2 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-39822

A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-39823

A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user's browser.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-39825

A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-472 - External Control of Assumed-Immutable Web Parameter
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-39826

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user's browser.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-42499

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1046 - Creation of Immutable Text Using String Concatenation
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-42501

A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Important
CVE-2026-42507

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-117 - Improper Output Neutralization for Logs
Affected products
Fixed 21 products, the same list as for CVE-2026-27137
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:61253 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2445345 external
https://bugzilla.redhat.com/show_bug.cgi?id=2456335 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467809 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467810 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467811 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467813 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467820 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467823 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467825 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467826 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 external
https://bugzilla.redhat.com/show_bug.cgi?id=2484205 external
https://bugzilla.redhat.com/show_bug.cgi?id=2484207 external
https://bugzilla.redhat.com/show_bug.cgi?id=2498152 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-27137 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445345 external
https://www.cve.org/CVERecord?id=CVE-2026-27137 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27137 external
https://go.dev/cl/752182 external
https://go.dev/issue/77952 external
https://groups.google.com/g/golang-announce/c/Edh… external
https://pkg.go.dev/vuln/GO-2026-4599 external
https://access.redhat.com/security/cve/CVE-2026-27145 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484207 external
https://www.cve.org/CVERecord?id=CVE-2026-27145 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27145 external
https://go.dev/cl/783621 external
https://go.dev/issue/79694 external
https://groups.google.com/g/golang-announce/c/tKs… external
https://pkg.go.dev/vuln/GO-2026-5037 external
https://access.redhat.com/security/cve/CVE-2026-33810 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456335 external
https://www.cve.org/CVERecord?id=CVE-2026-33810 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33810 external
https://go.dev/cl/763763 external
https://go.dev/issue/78332 external
https://groups.google.com/g/golang-announce/c/0uY… external
https://pkg.go.dev/vuln/GO-2026-4866 external
https://access.redhat.com/security/cve/CVE-2026-33811 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 external
https://www.cve.org/CVERecord?id=CVE-2026-33811 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33811 external
https://go.dev/cl/767860 external
https://go.dev/issue/78803 external
https://groups.google.com/g/golang-announce/c/qcC… external
https://pkg.go.dev/vuln/GO-2026-4981 external
https://access.redhat.com/security/cve/CVE-2026-33814 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 external
https://www.cve.org/CVERecord?id=CVE-2026-33814 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33814 external
https://go.dev/cl/761581 external
https://go.dev/cl/761640 external
https://go.dev/issue/78476 external
https://pkg.go.dev/vuln/GO-2026-4918 external
https://access.redhat.com/security/cve/CVE-2026-39817 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467825 external
https://www.cve.org/CVERecord?id=CVE-2026-39817 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39817 external
https://go.dev/cl/767520 external
https://go.dev/issue/78778 external
https://pkg.go.dev/vuln/GO-2026-4979 external
https://access.redhat.com/security/cve/CVE-2026-39819 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467813 external
https://www.cve.org/CVERecord?id=CVE-2026-39819 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39819 external
https://go.dev/cl/763882 external
https://go.dev/issue/78584 external
https://pkg.go.dev/vuln/GO-2026-4978 external
https://access.redhat.com/security/cve/CVE-2026-39820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467820 external
https://www.cve.org/CVERecord?id=CVE-2026-39820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39820 external
https://go.dev/cl/759940 external
https://go.dev/issue/78566 external
https://pkg.go.dev/vuln/GO-2026-4986 external
https://access.redhat.com/security/cve/CVE-2026-39821 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 external
https://www.cve.org/CVERecord?id=CVE-2026-39821 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39821 external
https://go.dev/cl/767220 external
https://go.dev/issue/78760 external
https://groups.google.com/g/golang-announce/c/iI-… external
https://pkg.go.dev/vuln/GO-2026-5026 external
https://access.redhat.com/security/cve/CVE-2026-39822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498152 external
https://www.cve.org/CVERecord?id=CVE-2026-39822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39822 external
https://go.dev/cl/797880 external
https://go.dev/issue/79005 external
https://groups.google.com/g/golang-announce/c/Orm… external
https://pkg.go.dev/vuln/GO-2026-4970 external
https://access.redhat.com/security/cve/CVE-2026-39823 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467811 external
https://www.cve.org/CVERecord?id=CVE-2026-39823 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39823 external
https://go.dev/cl/769920 external
https://go.dev/issue/78913 external
https://pkg.go.dev/vuln/GO-2026-4982 external
https://access.redhat.com/security/cve/CVE-2026-39825 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467823 external
https://www.cve.org/CVERecord?id=CVE-2026-39825 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39825 external
https://go.dev/cl/770541 external
https://go.dev/issue/78948 external
https://pkg.go.dev/vuln/GO-2026-4976 external
https://access.redhat.com/security/cve/CVE-2026-39826 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467826 external
https://www.cve.org/CVERecord?id=CVE-2026-39826 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39826 external
https://go.dev/cl/771180 external
https://go.dev/issue/78981 external
https://pkg.go.dev/vuln/GO-2026-4980 external
https://access.redhat.com/security/cve/CVE-2026-42499 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467809 external
https://www.cve.org/CVERecord?id=CVE-2026-42499 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42499 external
https://go.dev/cl/771520 external
https://go.dev/issue/78987 external
https://pkg.go.dev/vuln/GO-2026-4977 external
https://access.redhat.com/security/cve/CVE-2026-42501 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467810 external
https://www.cve.org/CVERecord?id=CVE-2026-42501 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42501 external
https://go.dev/cl/775321 external
https://go.dev/issue/79070 external
https://pkg.go.dev/vuln/GO-2026-4984 external
https://access.redhat.com/security/cve/CVE-2026-42504 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 external
https://www.cve.org/CVERecord?id=CVE-2026-42504 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504 external
https://go.dev/cl/774481 external
https://go.dev/issue/79217 external
https://pkg.go.dev/vuln/GO-2026-5038 external
https://access.redhat.com/security/cve/CVE-2026-42507 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484205 external
https://www.cve.org/CVERecord?id=CVE-2026-42507 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42507 external
https://go.dev/cl/777060 external
https://go.dev/issue/79346 external
https://pkg.go.dev/vuln/GO-2026-5039 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)\n\n* cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)\n\n* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n\n* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)\n\n* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)\n\n* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)\n\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)\n\n* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n\n* golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:61253",
        "url": "https://access.redhat.com/errata/RHSA-2026:61253"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2445345",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
      },
      {
        "category": "external",
        "summary": "2456335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
      },
      {
        "category": "external",
        "summary": "2467809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
      },
      {
        "category": "external",
        "summary": "2467810",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467810"
      },
      {
        "category": "external",
        "summary": "2467811",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
      },
      {
        "category": "external",
        "summary": "2467813",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467813"
      },
      {
        "category": "external",
        "summary": "2467815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
      },
      {
        "category": "external",
        "summary": "2467820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
      },
      {
        "category": "external",
        "summary": "2467822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
      },
      {
        "category": "external",
        "summary": "2467823",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
      },
      {
        "category": "external",
        "summary": "2467825",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
      },
      {
        "category": "external",
        "summary": "2467826",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2484205",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484205"
      },
      {
        "category": "external",
        "summary": "2484207",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
      },
      {
        "category": "external",
        "summary": "2498152",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61253.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security update",
    "tracking": {
      "current_release_date": "2026-09-26T21:11:45+00:00",
      "generator": {
        "date": "2026-09-26T21:11:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:61253",
      "initial_release_date": "2026-08-31T04:11:57+00:00",
      "revision_history": [
        {
          "date": "2026-08-31T04:11:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-31T04:11:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-26T21:11:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                  "product_id": "AppStream-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_2.aarch64",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_2.aarch64",
                  "product_id": "go-toolset-0:1.26.5-1.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_2.aarch64",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_2.aarch64",
                  "product_id": "golang-0:1.26.5-1.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_2.aarch64",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_2.aarch64",
                  "product_id": "golang-bin-0:1.26.5-1.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_2.aarch64",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_2.aarch64",
                  "product_id": "golang-race-0:1.26.5-1.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_2.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_2.ppc64le",
                  "product_id": "go-toolset-0:1.26.5-1.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_2.ppc64le",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_2.ppc64le",
                  "product_id": "golang-0:1.26.5-1.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_2.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_2.ppc64le",
                  "product_id": "golang-bin-0:1.26.5-1.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_2.ppc64le",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_2.ppc64le",
                  "product_id": "golang-race-0:1.26.5-1.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_2?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_2.x86_64",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_2.x86_64",
                  "product_id": "go-toolset-0:1.26.5-1.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_2.x86_64",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_2.x86_64",
                  "product_id": "golang-0:1.26.5-1.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_2.x86_64",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_2.x86_64",
                  "product_id": "golang-bin-0:1.26.5-1.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_2.x86_64",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_2.x86_64",
                  "product_id": "golang-race-0:1.26.5-1.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.5-1.el9_2.s390x",
                "product": {
                  "name": "go-toolset-0:1.26.5-1.el9_2.s390x",
                  "product_id": "go-toolset-0:1.26.5-1.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.5-1.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_2.s390x",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_2.s390x",
                  "product_id": "golang-0:1.26.5-1.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.5-1.el9_2.s390x",
                "product": {
                  "name": "golang-bin-0:1.26.5-1.el9_2.s390x",
                  "product_id": "golang-bin-0:1.26.5-1.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.5-1.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.5-1.el9_2.s390x",
                "product": {
                  "name": "golang-race-0:1.26.5-1.el9_2.s390x",
                  "product_id": "golang-race-0:1.26.5-1.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.5-1.el9_2?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.26.5-1.el9_2.src",
                "product": {
                  "name": "golang-0:1.26.5-1.el9_2.src",
                  "product_id": "golang-0:1.26.5-1.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.5-1.el9_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.26.5-1.el9_2.noarch",
                "product": {
                  "name": "golang-docs-0:1.26.5-1.el9_2.noarch",
                  "product_id": "golang-docs-0:1.26.5-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.26.5-1.el9_2?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.26.5-1.el9_2.noarch",
                "product": {
                  "name": "golang-misc-0:1.26.5-1.el9_2.noarch",
                  "product_id": "golang-misc-0:1.26.5-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.26.5-1.el9_2?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.26.5-1.el9_2.noarch",
                "product": {
                  "name": "golang-src-0:1.26.5-1.el9_2.noarch",
                  "product_id": "golang-src-0:1.26.5-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.26.5-1.el9_2?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.26.5-1.el9_2.noarch",
                "product": {
                  "name": "golang-tests-0:1.26.5-1.el9_2.noarch",
                  "product_id": "golang-tests-0:1.26.5-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.26.5-1.el9_2?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.5-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64"
        },
        "product_reference": "go-toolset-0:1.26.5-1.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64"
        },
        "product_reference": "golang-0:1.26.5-1.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le"
        },
        "product_reference": "golang-0:1.26.5-1.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x"
        },
        "product_reference": "golang-0:1.26.5-1.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src"
        },
        "product_reference": "golang-0:1.26.5-1.el9_2.src",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.5-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64"
        },
        "product_reference": "golang-0:1.26.5-1.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.5-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64"
        },
        "product_reference": "golang-bin-0:1.26.5-1.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.26.5-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch"
        },
        "product_reference": "golang-docs-0:1.26.5-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.26.5-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch"
        },
        "product_reference": "golang-misc-0:1.26.5-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.5-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64"
        },
        "product_reference": "golang-race-0:1.26.5-1.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.26.5-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch"
        },
        "product_reference": "golang-src-0:1.26.5-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.26.5-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        },
        "product_reference": "golang-tests-0:1.26.5-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27137",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-03-06T22:01:38.859733+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752182",
          "url": "https://go.dev/cl/752182"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77952",
          "url": "https://go.dev/issue/77952"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4599",
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "release_date": "2026-03-06T21:28:13.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
    },
    {
      "cve": "CVE-2026-27145",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-02T23:01:08.992540+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/783621",
          "url": "https://go.dev/cl/783621"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79694",
          "url": "https://go.dev/issue/79694"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5037",
          "url": "https://pkg.go.dev/vuln/GO-2026-5037"
        }
      ],
      "release_date": "2026-06-02T22:01:36.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "cve": "CVE-2026-33810",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-08T02:01:09.100830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763763",
          "url": "https://go.dev/cl/763763"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78332",
          "url": "https://go.dev/issue/78332"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4866",
          "url": "https://pkg.go.dev/vuln/GO-2026-4866"
        }
      ],
      "release_date": "2026-04-08T01:06:56.546000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
    },
    {
      "cve": "CVE-2026-33811",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-05-07T20:01:34.913869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767860",
          "url": "https://go.dev/cl/767860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78803",
          "url": "https://go.dev/issue/78803"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4981",
          "url": "https://pkg.go.dev/vuln/GO-2026-4981"
        }
      ],
      "release_date": "2026-05-07T19:41:19.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "cve": "CVE-2026-33814",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:11.324941+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the HTTP/2 protocol implementation within the Go standard library (golang.org/x/net and net/http/internal/http2). A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGS_MAX_FRAME_SIZE parameter set to zero. This malicious frame causes the transport layer to enter an infinite loop of writing CONTINUATION frames, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in the Go HTTP/2 protocol implementation allows a remote, unauthenticated attacker to exhaust system resources. By sending a specially crafted HTTP/2 SETTINGS frame with a zero-value SETTINGS_MAX_FRAME_SIZE, the vulnerable Go library enters an infinite loop, impacting the availability of services utilizing HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/761581",
          "url": "https://go.dev/cl/761581"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/761640",
          "url": "https://go.dev/cl/761640"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78476",
          "url": "https://go.dev/issue/78476"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4918",
          "url": "https://pkg.go.dev/vuln/GO-2026-4918"
        }
      ],
      "release_date": "2026-05-07T19:41:17.631000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "cve": "CVE-2026-39817",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-05-07T20:01:43.510043+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \"go tool pack\" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the \"pack\" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39817",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767520",
          "url": "https://go.dev/cl/767520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78778",
          "url": "https://go.dev/issue/78778"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4979",
          "url": "https://pkg.go.dev/vuln/GO-2026-4979"
        }
      ],
      "release_date": "2026-05-07T19:41:18.993000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction"
    },
    {
      "cve": "CVE-2026-39819",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-05-07T20:01:04.403877+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \u0027go bug\u0027 command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system\u0027s temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the \u0027go bug\u0027 command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763882",
          "url": "https://go.dev/cl/763882"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78584",
          "url": "https://go.dev/issue/78584"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4978",
          "url": "https://pkg.go.dev/vuln/GO-2026-4978"
        }
      ],
      "release_date": "2026-05-07T19:41:18.849000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack"
    },
    {
      "cve": "CVE-2026-39820",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:27.800929+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/759940",
          "url": "https://go.dev/cl/759940"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78566",
          "url": "https://go.dev/issue/78566"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4986",
          "url": "https://pkg.go.dev/vuln/GO-2026-4986"
        }
      ],
      "release_date": "2026-05-07T19:41:19.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-39822",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-07-08T17:01:53.592869+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498152"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `os.Root` functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: Go os.Root: Symlink following vulnerability allows directory traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Go\u0027s os.Root implementation. On Unix systems, `os.Root.Open()` improperly follows symlinks to locations outside the root directory when the path ends with a trailing slash (e.g., root.Open(\"symlink/\")). This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5.\n\nThe following symbols are affected:\n* `OpenInRoot`: Opens a file or directory within an `os.Root`.\n* `Root.Create`: Creates a file inside an `os.Root`.\n* `Root.Open`: Opens a path relative to an `os.Root`.\n* `Root.OpenFile`: Opens a file with specified flags and permissions inside an `os.Root`.\n* `Root.OpenRoot`: Opens a sub-root directory from an `os.Root`.\n* `Root.ReadFile`: Reads a file inside an `os.Root`.\n* `Root.WriteFile`: Writes a file inside an `os.Root`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498152",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/797880",
          "url": "https://go.dev/cl/797880"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79005",
          "url": "https://go.dev/issue/79005"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc",
          "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4970",
          "url": "https://pkg.go.dev/vuln/GO-2026-4970"
        }
      ],
      "release_date": "2026-07-08T15:46:27.199000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go \u003e= 1.24 that do not use the os.Root API are not affected by this vulnerability.\nThe os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected.\nThis issue is fixed in Go 1.25.12 and Go 1.26.5.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "cve": "CVE-2026-39823",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-07T20:00:58.284024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467811"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL\u0027s content attribute inside a `\u003cmeta\u003e` tag. This improper escaping could lead to Cross-Site Scripting (XSS), allowing the attacker to execute malicious scripts in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products ship the Go `html/template` package as a dependency of various Go-based components. The affected functionality involves URL escaping inside `\u003cmeta\u003e` tag content attributes, which requires an application to render user-controlled URLs in meta tags using `html/template`. While the vulnerable code is present, exploitation requires a specific usage pattern that is uncommon in Red Hat product code paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39823"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467811",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467811"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39823",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39823"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39823"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/769920",
          "url": "https://go.dev/cl/769920"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78913",
          "url": "https://go.dev/issue/78913"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4982",
          "url": "https://pkg.go.dev/vuln/GO-2026-4982"
        }
      ],
      "release_date": "2026-05-07T19:41:19.524000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Ensure that user-supplied URLs are validated and sanitized before being passed to Go\u0027s `html/template` package for rendering in HTML meta tag content attributes. Avoid rendering untrusted URL data directly in meta tag content attributes.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content"
    },
    {
      "cve": "CVE-2026-39825",
      "cwe": {
        "id": "CWE-472",
        "name": "External Control of Assumed-Immutable Web Parameter"
      },
      "discovery_date": "2026-05-07T20:01:37.714133+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs because the `ReverseProxy` does not correctly consider the `url.ParseQuery` limit on the total number of query parameters. A remote attacker could exploit this to send hidden query parameters, potentially bypassing security policies or controls implemented by `Rewrite` functions, leading to information disclosure or unexpected behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Go\u0027s net/http/httputil package where ReverseProxy can forward query parameters that are hidden from Rewrite or Director functions. This occurs when the number of query parameters exceeds the url.ParseQuery limit (controlled by the GODEBUG setting urlmaxqueryparams). While Red Hat ships Go-based components across many products, exploitation requires that an application use ReverseProxy with a Rewrite or Director function that relies on query parameter inspection for security enforcement, which limits the practical impact of this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39825"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/770541",
          "url": "https://go.dev/cl/770541"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78948",
          "url": "https://go.dev/issue/78948"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4976",
          "url": "https://pkg.go.dev/vuln/GO-2026-4976"
        }
      ],
      "release_date": "2026-05-07T19:41:18.453000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy\u0027s Rewrite or Director function for security filtering.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls"
    },
    {
      "cve": "CVE-2026-39826",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-07T20:01:46.305827+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467826"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only \u0027type\u0027 attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting (XSS). An attacker could leverage this to execute arbitrary client-side scripts in a user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate cross-site scripting (XSS) vulnerability in Go\u0027s html/template package occurs when a script tag with an empty or whitespace-only \u0027type\u0027 attribute is used in a template, causing the template engine to incorrectly escape data passed into the script block. This requires a trusted template author to introduce the vulnerable template pattern before an attacker can inject malicious scripts.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39826"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467826",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467826"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39826",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39826"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39826"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771180",
          "url": "https://go.dev/cl/771180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78981",
          "url": "https://go.dev/issue/78981"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4980",
          "url": "https://pkg.go.dev/vuln/GO-2026-4980"
        }
      ],
      "release_date": "2026-05-07T19:41:19.138000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping"
    },
    {
      "cve": "CVE-2026-42499",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2026-05-07T20:00:51.685602+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771520",
          "url": "https://go.dev/cl/771520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78987",
          "url": "https://go.dev/issue/78987"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4977",
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "release_date": "2026-05-07T19:41:18.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "cve": "CVE-2026-42501",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-05-07T20:00:54.811489+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467810"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` command may then download and execute without proper verification. This can lead to the execution of untrusted code, compromising the integrity of the Go development environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in the Go command (`cmd/go`) allows a malicious module proxy to bypass checksum validation, potentially leading to the execution of untrusted Go toolchains. Red Hat products utilizing the Go command are vulnerable if configured to use an untrusted module proxy or checksum database, as this could compromise the integrity of the Go development environment. Exploitation requires user interaction with a compromised proxy.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42501"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467810",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467810"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42501"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/775321",
          "url": "https://go.dev/cl/775321"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79070",
          "url": "https://go.dev/issue/79070"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4984",
          "url": "https://pkg.go.dev/vuln/GO-2026-4984"
        }
      ],
      "release_date": "2026-05-07T19:41:19.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "To verify the integrity of Go module dependencies and detect potential tampering by a malicious proxy, users can revalidate all dependencies of the current module. This process involves removing the existing `go.sum` file and then re-generating and verifying module checksums.\n\nExecute the following commands in your module\u0027s root directory:\n```bash\nrm go.sum\ngo mod tidy\ngo mod verify\n```\nThis operation will re-download and re-verify all module dependencies. Be aware that this may affect your local module cache and could require re-building projects.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-42507",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2026-06-02T23:01:03.125126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484205"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead to confusion or misinterpretation of critical system information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42507"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484205",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484205"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42507",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42507"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42507"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/777060",
          "url": "https://go.dev/cl/777060"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79346",
          "url": "https://go.dev/issue/79346"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5039",
          "url": "https://pkg.go.dev/vuln/GO-2026-5039"
        }
      ],
      "release_date": "2026-06-02T22:01:37.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-31T04:11:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:61253"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:go-toolset-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:golang-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-bin-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-docs-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-misc-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:golang-race-0:1.26.5-1.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:golang-src-0:1.26.5-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:golang-tests-0:1.26.5-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: golang: Golang net/textproto: Misleading error messages via input injection"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.