Vulnerability-Lookup

RHSA-2026:85899

Vulnerability from csaf_redhat - Published: 2026-10-20 09:59 - Updated: 2026-10-23 19:33

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: golang1.26: * golang1.26-1.26.10-0.1.hum1 (aarch64, s390x, x86_64) * golang1.26-bin-1.26.10-0.1.hum1 (aarch64, s390x, x86_64) * golang1.26-docs-1.26.10-0.1.hum1 (noarch) * golang1.26-misc-1.26.10-0.1.hum1 (noarch) * golang1.26-src-1.26.10-0.1.hum1 (noarch) * golang1.26-tests-1.26.10-0.1.hum1 (noarch) * golang1.26-1.26.10-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 19 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-97030

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user's web browser.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 19 products, the same list as for CVE-2026-94440

Threats

Impact Moderate

CVE-2026-111943

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 19 products, the same list as for CVE-2026-94440

Threats

Impact Important

References

29 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:85899	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-111943	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-97030	external
https://access.redhat.com/security/cve/CVE-2026-94440	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-94440	self
https://bugzilla.redhat.com/show_bug.cgi?id=2548341	external
https://www.cve.org/CVERecord?id=CVE-2026-94440	external
https://nvd.nist.gov/vuln/detail/CVE-2026-94440	external
https://go.dev/cl/847307	external
https://go.dev/issue/81741	external
https://groups.google.com/g/golang-announce/c/U2f…	external
https://pkg.go.dev/vuln/GO-2026-6608	external
https://access.redhat.com/security/cve/CVE-2026-97030	self
https://bugzilla.redhat.com/show_bug.cgi?id=2548338	external
https://www.cve.org/CVERecord?id=CVE-2026-97030	external
https://nvd.nist.gov/vuln/detail/CVE-2026-97030	external
https://go.dev/cl/840925	external
https://go.dev/issue/81823	external
https://pkg.go.dev/vuln/GO-2026-6600	external
https://access.redhat.com/security/cve/CVE-2026-111943	self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068	external
https://access.redhat.com/security/vulnerabilitie…	external
https://www.cve.org/CVERecord?id=CVE-2026-111943	external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943	external
https://github.com/golang/go/issues/82345	external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngolang1.26:\n  * golang1.26-1.26.10-0.1.hum1 (aarch64, s390x, x86_64)\n  * golang1.26-bin-1.26.10-0.1.hum1 (aarch64, s390x, x86_64)\n  * golang1.26-docs-1.26.10-0.1.hum1 (noarch)\n  * golang1.26-misc-1.26.10-0.1.hum1 (noarch)\n  * golang1.26-src-1.26.10-0.1.hum1 (noarch)\n  * golang1.26-tests-1.26.10-0.1.hum1 (noarch)\n  * golang1.26-1.26.10-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85899",
        "url": "https://access.redhat.com/errata/RHSA-2026:85899"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111943",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97030",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97030"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-94440",
        "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85899.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-23T19:33:06+00:00",
      "generator": {
        "date": "2026-10-23T19:33:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:85899",
      "initial_release_date": "2026-10-20T09:59:54+00:00",
      "revision_history": [
        {
          "date": "2026-10-20T09:59:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-22T23:18:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-23T19:33:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.26-0:1.26.10-0.1.hum1@aarch64",
                "product": {
                  "name": "golang1.26-0:1.26.10-0.1.hum1@aarch64",
                  "product_id": "golang1.26-0:1.26.10-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26@1.26.10-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
                "product": {
                  "name": "golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
                  "product_id": "golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-bin@1.26.10-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.26-0:1.26.10-0.1.hum1@s390x",
                "product": {
                  "name": "golang1.26-0:1.26.10-0.1.hum1@s390x",
                  "product_id": "golang1.26-0:1.26.10-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26@1.26.10-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
                "product": {
                  "name": "golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
                  "product_id": "golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-bin@1.26.10-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.26-0:1.26.10-0.1.hum1@src",
                "product": {
                  "name": "golang1.26-0:1.26.10-0.1.hum1@src",
                  "product_id": "golang1.26-0:1.26.10-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26@1.26.10-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.26-0:1.26.10-0.1.hum1@x86_64",
                "product": {
                  "name": "golang1.26-0:1.26.10-0.1.hum1@x86_64",
                  "product_id": "golang1.26-0:1.26.10-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26@1.26.10-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
                "product": {
                  "name": "golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
                  "product_id": "golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-bin@1.26.10-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-docs@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-docs@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-docs@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-misc@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-misc@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-misc@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-src@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-src@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-src@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-tests@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                "product": {
                  "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_id": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-tests@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.26-tests@1.26.10-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-0:1.26.10-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64"
        },
        "product_reference": "golang1.26-0:1.26.10-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-0:1.26.10-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x"
        },
        "product_reference": "golang1.26-0:1.26.10-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-0:1.26.10-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src"
        },
        "product_reference": "golang1.26-0:1.26.10-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-0:1.26.10-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64"
        },
        "product_reference": "golang1.26-0:1.26.10-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-bin-0:1.26.10-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64"
        },
        "product_reference": "golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-bin-0:1.26.10-0.1.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x"
        },
        "product_reference": "golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-bin-0:1.26.10-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64"
        },
        "product_reference": "golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms"
        },
        "product_reference": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-94440",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:17.316758+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847307",
          "url": "https://go.dev/cl/847307"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81741",
          "url": "https://go.dev/issue/81741"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6608",
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "release_date": "2026-10-08T22:53:58.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T09:59:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85899"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing"
    },
    {
      "cve": "CVE-2026-97030",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:06.022541+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the \u0027yield\u0027 keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user\u0027s web browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/840925",
          "url": "https://go.dev/cl/840925"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81823",
          "url": "https://go.dev/issue/81823"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6600",
          "url": "https://pkg.go.dev/vuln/GO-2026-6600"
        }
      ],
      "release_date": "2026-10-08T22:53:57.597000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T09:59:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85899"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
          "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
          "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T09:59:54+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85899"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.26-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@s390x",
            "Red Hat Hardened Images:golang1.26-bin-0:1.26.10-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-docs-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-misc-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-src-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-s390x-rpms",
            "Red Hat Hardened Images:golang1.26-tests-0:1.26.10-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}

CVE-2026-111943 (GCVE-0-2026-111943)

Vulnerability from cvelistv5 – Published: 2026-10-21 00:52 – Updated: 2026-10-21 01:24

Title

Distrust compromised intermediate certificates in crypto/x509

Summary

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

Severity

No CVSS data available.

CWE

CWE-299 - Improper Check for Certificate Revocation

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/cl/851047
https://go.dev/issue/82345
https://groups.google.com/g/golang-announce/c/66p…
https://pkg.go.dev/vuln/GO-2026-6809
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.26.10 (semver) Affected: 1.27.0-0 , < 1.27.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:24:20.498Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-299: Improper Check for Certificate Revocation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T00:52:18.359Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/851047"
        },
        {
          "url": "https://go.dev/issue/82345"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/66pojueaQek"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "title": "Distrust compromised intermediate certificates in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-111943",
    "datePublished": "2026-10-21T00:52:18.359Z",
    "dateReserved": "2026-10-17T13:43:28.599Z",
    "dateUpdated": "2026-10-21T01:24:20.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94440 (GCVE-0-2026-94440)

Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-09 16:09

Title

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Summary

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 16:09 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/847307
https://go.dev/issue/81741
https://groups.google.com/g/golang-announce/c/U2f…
https://pkg.go.dev/vuln/GO-2026-6608

Impacted products

2 products

Vendor	Product	Version
Go standard library	net/textproto	Affected: 0 , < 1.26.9 (semver) Affected: 1.27.0-0 , < 1.27.2 (semver)
Go standard library	mime/multipart	Affected: 0 , < 1.26.9 (semver) Affected: 1.27.0-0 , < 1.27.2 (semver)

Credits

Jakub Ciolek (https://ciolek.dev)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-94440",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T16:09:04.864512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T16:09:59.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/textproto",
          "product": "net/textproto",
          "programRoutines": [
            {
              "name": "readMIMEHeader"
            },
            {
              "name": "Reader.readContinuedLineSlice"
            },
            {
              "name": "Reader.ReadContinuedLine"
            },
            {
              "name": "Reader.ReadContinuedLineBytes"
            },
            {
              "name": "Reader.ReadMIMEHeader"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "mime/multipart",
          "product": "mime/multipart",
          "programRoutines": [
            {
              "name": "Part.populateHeaders"
            },
            {
              "name": "Reader.readForm"
            },
            {
              "name": "Reader.NextPart"
            },
            {
              "name": "Reader.NextRawPart"
            },
            {
              "name": "Reader.ReadForm"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek (https://ciolek.dev)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:53:58.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/847307"
        },
        {
          "url": "https://go.dev/issue/81741"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "title": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-94440",
    "datePublished": "2026-10-08T22:53:58.959Z",
    "dateReserved": "2026-09-21T16:43:04.757Z",
    "dateUpdated": "2026-10-09T16:09:59.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97030 (GCVE-0-2026-97030)

Vulnerability from cvelistv5 – Published: 2026-10-08 22:53 – Updated: 2026-10-15 15:30

Title

Recognize yield as regexp preceder keyword in html/template

Summary

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:30 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/840925
https://go.dev/issue/81823
https://groups.google.com/g/golang-announce/c/U2f…
https://pkg.go.dev/vuln/GO-2026-6600

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.26.9 (semver) Affected: 1.27.0-0 , < 1.27.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-97030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:30:23.923887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:30:28.303Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "nextJSCtx"
            },
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.2",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A trusted template author may have previously written a valid template wherein the use of the \u0027yield\u0027 keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:53:57.597Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/840925"
        },
        {
          "url": "https://go.dev/issue/81823"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6600"
        }
      ],
      "title": "Recognize yield as regexp preceder keyword in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-97030",
    "datePublished": "2026-10-08T22:53:57.597Z",
    "dateReserved": "2026-09-23T23:03:01.995Z",
    "dateUpdated": "2026-10-15T15:30:28.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:85899

CVE-2026-111943 (GCVE-0-2026-111943)

CVE-2026-94440 (GCVE-0-2026-94440)

CVE-2026-97030 (GCVE-0-2026-97030)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour