RHSA-2026:86196

Vulnerability from csaf_opensuse - Published: 2026-10-20 22:57 - Updated: 2026-10-23 19:33
Summary
Red Hat Security Advisory: golang security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [rhel-9.8.z] (JIRA:RHEL-287192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-78659

A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service (DoS) by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker can exhaust system memory resources and cause the application to crash.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-78660

A flaw was found in Go's net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this flaw by sending malformed response headers, resulting in HTTP response smuggling, where message boundaries between the proxy and client become desynchronized. This issue may allow attackers to bypass security controls, poison web caches, or intercept sensitive data from other user sessions.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-78667

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Important
CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Important
CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-94444

A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy (GOMODPROXY), the proxy can serve an arbitrary replacement module that still passes local verification. This can lead to arbitrary code execution during Go build or module download operations.

6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-354 - Improper Validation of Integrity Check Value
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-94447

A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be downloaded and executed.

6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-354 - Improper Validation of Integrity Check Value
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-94448

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user's browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-97030

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user's web browser.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-97031

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Important
CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-366 - Race Condition within a Thread
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Moderate
CVE-2026-111943

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 21 products, the same list as for CVE-2026-56866
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:86196 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2548334 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548336 external
https://bugzilla.redhat.com/show_bug.cgi?id=2548344 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://issues.redhat.com/browse/RHEL-287192 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-56866 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548347 external
https://www.cve.org/CVERecord?id=CVE-2026-56866 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56866 external
https://go.dev/cl/847306 external
https://go.dev/issue/81740 external
https://groups.google.com/g/golang-announce/c/U2f… external
https://pkg.go.dev/vuln/GO-2026-6605 external
https://access.redhat.com/security/cve/CVE-2026-78659 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548339 external
https://www.cve.org/CVERecord?id=CVE-2026-78659 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78659 external
https://go.dev/cl/847185 external
https://go.dev/cl/847314 external
https://go.dev/issue/81857 external
https://groups.google.com/g/golang-announce/c/ZPw… external
https://pkg.go.dev/vuln/GO-2026-6603 external
https://access.redhat.com/security/cve/CVE-2026-78660 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548340 external
https://www.cve.org/CVERecord?id=CVE-2026-78660 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78660 external
https://go.dev/cl/835145 external
https://go.dev/cl/836385 external
https://go.dev/issue/81115 external
https://pkg.go.dev/vuln/GO-2026-6610 external
https://access.redhat.com/security/cve/CVE-2026-78663 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548345 external
https://www.cve.org/CVERecord?id=CVE-2026-78663 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78663 external
https://go.dev/cl/847187 external
https://go.dev/cl/847310 external
https://go.dev/issue/81743 external
https://pkg.go.dev/vuln/GO-2026-6612 external
https://access.redhat.com/security/cve/CVE-2026-78667 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548334 external
https://www.cve.org/CVERecord?id=CVE-2026-78667 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78667 external
https://go.dev/cl/847309 external
https://go.dev/issue/81858 external
https://pkg.go.dev/vuln/GO-2026-6609 external
https://access.redhat.com/security/cve/CVE-2026-78669 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548344 external
https://www.cve.org/CVERecord?id=CVE-2026-78669 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78669 external
https://go.dev/cl/847186 external
https://go.dev/cl/847308 external
https://go.dev/issue/81742 external
https://pkg.go.dev/vuln/GO-2026-6611 external
https://access.redhat.com/security/cve/CVE-2026-94439 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548335 external
https://www.cve.org/CVERecord?id=CVE-2026-94439 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94439 external
https://go.dev/cl/847311 external
https://go.dev/issue/81744 external
https://pkg.go.dev/vuln/GO-2026-6613 external
https://access.redhat.com/security/cve/CVE-2026-94440 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548341 external
https://www.cve.org/CVERecord?id=CVE-2026-94440 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94440 external
https://go.dev/cl/847307 external
https://go.dev/issue/81741 external
https://pkg.go.dev/vuln/GO-2026-6608 external
https://access.redhat.com/security/cve/CVE-2026-94444 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548343 external
https://www.cve.org/CVERecord?id=CVE-2026-94444 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94444 external
https://go.dev/cl/840685 external
https://go.dev/issue/81833 external
https://pkg.go.dev/vuln/GO-2026-6601 external
https://access.redhat.com/security/cve/CVE-2026-94447 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548342 external
https://www.cve.org/CVERecord?id=CVE-2026-94447 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94447 external
https://go.dev/cl/840785 external
https://go.dev/issue/81834 external
https://pkg.go.dev/vuln/GO-2026-6602 external
https://access.redhat.com/security/cve/CVE-2026-94448 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548346 external
https://www.cve.org/CVERecord?id=CVE-2026-94448 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94448 external
https://go.dev/cl/839866 external
https://go.dev/issue/81821 external
https://pkg.go.dev/vuln/GO-2026-6599 external
https://access.redhat.com/security/cve/CVE-2026-97030 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548338 external
https://www.cve.org/CVERecord?id=CVE-2026-97030 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97030 external
https://go.dev/cl/840925 external
https://go.dev/issue/81823 external
https://pkg.go.dev/vuln/GO-2026-6600 external
https://access.redhat.com/security/cve/CVE-2026-97031 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548336 external
https://www.cve.org/CVERecord?id=CVE-2026-97031 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97031 external
https://go.dev/cl/847312 external
https://go.dev/issue/81855 external
https://pkg.go.dev/vuln/GO-2026-6607 external
https://access.redhat.com/security/cve/CVE-2026-97032 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548337 external
https://www.cve.org/CVERecord?id=CVE-2026-97032 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97032 external
https://go.dev/cl/847188 external
https://go.dev/cl/847313 external
https://go.dev/issue/81867 external
https://pkg.go.dev/vuln/GO-2026-6617 external
https://access.redhat.com/security/cve/CVE-2026-111943 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-111943 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943 external
https://github.com/golang/go/issues/82345 external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)\n\n* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n\n* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)\n\nBug Fix(es) and Enhancement(s):\n\n* Update Go to version 1.26.10+1 [rhel-9.8.z] (JIRA:RHEL-287192)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:86196",
        "url": "https://access.redhat.com/errata/RHSA-2026:86196"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2548334",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
      },
      {
        "category": "external",
        "summary": "2548336",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
      },
      {
        "category": "external",
        "summary": "2548344",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
      },
      {
        "category": "external",
        "summary": "2556068",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
      },
      {
        "category": "external",
        "summary": "RHEL-287192",
        "url": "https://issues.redhat.com/browse/RHEL-287192"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86196.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-23T19:33:08+00:00",
      "generator": {
        "date": "2026-10-23T19:33:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:86196",
      "initial_release_date": "2026-10-20T22:57:24+00:00",
      "revision_history": [
        {
          "date": "2026-10-20T22:57:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-20T22:57:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-23T19:33:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.10-1.el9_8.aarch64",
                "product": {
                  "name": "go-toolset-0:1.26.10-1.el9_8.aarch64",
                  "product_id": "go-toolset-0:1.26.10-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.10-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-1.el9_8.aarch64",
                "product": {
                  "name": "golang-0:1.26.10-1.el9_8.aarch64",
                  "product_id": "golang-0:1.26.10-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.10-1.el9_8.aarch64",
                "product": {
                  "name": "golang-bin-0:1.26.10-1.el9_8.aarch64",
                  "product_id": "golang-bin-0:1.26.10-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.10-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.10-1.el9_8.aarch64",
                "product": {
                  "name": "golang-race-0:1.26.10-1.el9_8.aarch64",
                  "product_id": "golang-race-0:1.26.10-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.10-1.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.10-1.el9_8.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.26.10-1.el9_8.ppc64le",
                  "product_id": "go-toolset-0:1.26.10-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.10-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-0:1.26.10-1.el9_8.ppc64le",
                  "product_id": "golang-0:1.26.10-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.10-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.26.10-1.el9_8.ppc64le",
                  "product_id": "golang-bin-0:1.26.10-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.10-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.10-1.el9_8.ppc64le",
                "product": {
                  "name": "golang-race-0:1.26.10-1.el9_8.ppc64le",
                  "product_id": "golang-race-0:1.26.10-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.10-1.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.10-1.el9_8.s390x",
                "product": {
                  "name": "go-toolset-0:1.26.10-1.el9_8.s390x",
                  "product_id": "go-toolset-0:1.26.10-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.10-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-1.el9_8.s390x",
                "product": {
                  "name": "golang-0:1.26.10-1.el9_8.s390x",
                  "product_id": "golang-0:1.26.10-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.10-1.el9_8.s390x",
                "product": {
                  "name": "golang-bin-0:1.26.10-1.el9_8.s390x",
                  "product_id": "golang-bin-0:1.26.10-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.10-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.10-1.el9_8.s390x",
                "product": {
                  "name": "golang-race-0:1.26.10-1.el9_8.s390x",
                  "product_id": "golang-race-0:1.26.10-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.10-1.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.26.10-1.el9_8.x86_64",
                "product": {
                  "name": "go-toolset-0:1.26.10-1.el9_8.x86_64",
                  "product_id": "go-toolset-0:1.26.10-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.26.10-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-1.el9_8.x86_64",
                "product": {
                  "name": "golang-0:1.26.10-1.el9_8.x86_64",
                  "product_id": "golang-0:1.26.10-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.26.10-1.el9_8.x86_64",
                "product": {
                  "name": "golang-bin-0:1.26.10-1.el9_8.x86_64",
                  "product_id": "golang-bin-0:1.26.10-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.26.10-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.26.10-1.el9_8.x86_64",
                "product": {
                  "name": "golang-race-0:1.26.10-1.el9_8.x86_64",
                  "product_id": "golang-race-0:1.26.10-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.26.10-1.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.26.10-1.el9_8.src",
                "product": {
                  "name": "golang-0:1.26.10-1.el9_8.src",
                  "product_id": "golang-0:1.26.10-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.26.10-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.26.10-1.el9_8.noarch",
                "product": {
                  "name": "golang-docs-0:1.26.10-1.el9_8.noarch",
                  "product_id": "golang-docs-0:1.26.10-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.26.10-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.26.10-1.el9_8.noarch",
                "product": {
                  "name": "golang-misc-0:1.26.10-1.el9_8.noarch",
                  "product_id": "golang-misc-0:1.26.10-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.26.10-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.26.10-1.el9_8.noarch",
                "product": {
                  "name": "golang-src-0:1.26.10-1.el9_8.noarch",
                  "product_id": "golang-src-0:1.26.10-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.26.10-1.el9_8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.26.10-1.el9_8.noarch",
                "product": {
                  "name": "golang-tests-0:1.26.10-1.el9_8.noarch",
                  "product_id": "golang-tests-0:1.26.10-1.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.26.10-1.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64"
        },
        "product_reference": "go-toolset-0:1.26.10-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le"
        },
        "product_reference": "go-toolset-0:1.26.10-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x"
        },
        "product_reference": "go-toolset-0:1.26.10-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.26.10-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64"
        },
        "product_reference": "go-toolset-0:1.26.10-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64"
        },
        "product_reference": "golang-0:1.26.10-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le"
        },
        "product_reference": "golang-0:1.26.10-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x"
        },
        "product_reference": "golang-0:1.26.10-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src"
        },
        "product_reference": "golang-0:1.26.10-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.26.10-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64"
        },
        "product_reference": "golang-0:1.26.10-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64"
        },
        "product_reference": "golang-bin-0:1.26.10-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le"
        },
        "product_reference": "golang-bin-0:1.26.10-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x"
        },
        "product_reference": "golang-bin-0:1.26.10-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.26.10-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64"
        },
        "product_reference": "golang-bin-0:1.26.10-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch"
        },
        "product_reference": "golang-docs-0:1.26.10-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch"
        },
        "product_reference": "golang-misc-0:1.26.10-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64"
        },
        "product_reference": "golang-race-0:1.26.10-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le"
        },
        "product_reference": "golang-race-0:1.26.10-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x"
        },
        "product_reference": "golang-race-0:1.26.10-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.26.10-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64"
        },
        "product_reference": "golang-race-0:1.26.10-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch"
        },
        "product_reference": "golang-src-0:1.26.10-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        },
        "product_reference": "golang-tests-0:1.26.10-1.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56866",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:40.419728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548347"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw of moderate impact was found in the Go standard library net/http package, which is shipped by a broad range of Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset components), Red Hat Enterprise Linux AI, OpenShift Container Platform and other Go-based components across Red Hat\u0027s portfolio. When http.Transport sends an HTTP/1 CONNECT request that carries a non-empty request body, the body is written to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the desynchronized connection to the shared idle pool, and the trailing body bytes can be interpreted by the server as a subsequent pipelined request. A remote attacker able to send requests through a reverse proxy (including httputil.ReverseProxy) that forwards CONNECT requests via a shared Transport could exploit this to poison the responses received by other users of the pooled connection, potentially exposing sensitive information or serving unintended content to them. Red Hat rates this flaw MODERATE (CVSS 6.5, limited confidentiality and integrity impact with no availability impact), which is lower than the CISA score of 7.5 (IMPORTANT) based on a confidentiality-only vector; Red Hat\u0027s assessment reflects that the exposure requires a shared reverse-proxy deployment that forwards CONNECT requests with bodies and yields low confidentiality and integrity impact. For most affected Red Hat products the fix is deferred because the flaw is rated MODERATE severity with a CVSS score below 7.0, so the residual risk of cross-user response poisoning in such proxy deployments remains until a fix is delivered; for a subset of affected products fixes are being pursued by their maintaining teams, and some affected streams are out of active support.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548347",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548347"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847306",
          "url": "https://go.dev/cl/847306"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81740",
          "url": "https://go.dev/issue/81740"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6605",
          "url": "https://pkg.go.dev/vuln/GO-2026-6605"
        }
      ],
      "release_date": "2026-10-08T22:53:58.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections"
    },
    {
      "cve": "CVE-2026-78659",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:09.199211+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. A remote attacker can trigger a Denial of Service (DoS) by sending HTTP/2 requests that declare an excessive number of trailer header fields. Because the server bypasses configured header limits when allocating memory for these declarations, an attacker can exhaust system memory resources and cause the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78659"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78659",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78659"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78659",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78659"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847185",
          "url": "https://go.dev/cl/847185"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847314",
          "url": "https://go.dev/cl/847314"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81857",
          "url": "https://go.dev/issue/81857"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6603",
          "url": "https://pkg.go.dev/vuln/GO-2026-6603"
        }
      ],
      "release_date": "2026-10-08T22:53:58.192000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion"
    },
    {
      "cve": "CVE-2026-78660",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:13.561809+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. When operating as a reverse proxy, the HTTP/2 implementation does not properly validate framing-related headers in responses received from upstream servers before forwarding them to downstream HTTP/1 clients. A malicious upstream server can exploit this flaw by sending malformed response headers, resulting in HTTP response smuggling, where message boundaries between the proxy and client become desynchronized. This issue may allow attackers to bypass security controls, poison web caches, or intercept sensitive data from other user sessions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78660"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78660",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78660"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78660",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78660"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/835145",
          "url": "https://go.dev/cl/835145"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/836385",
          "url": "https://go.dev/cl/836385"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81115",
          "url": "https://go.dev/issue/81115"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6610",
          "url": "https://pkg.go.dev/vuln/GO-2026-6610"
        }
      ],
      "release_date": "2026-10-08T22:53:59.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers"
    },
    {
      "cve": "CVE-2026-78663",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:32.835933+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits\u2014mechanisms that regulate incoming network data\u2014potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having a Moderate security impact because, while remote unauthenticated clients can bypass configured connection receive buffer thresholds on affected HTTP/2 servers, overall resource exhaustion remains bounded. Exploitation is constrained by stream-level flow controls and limits on concurrent streams, which prevents an attacker from causing unbounded memory consumption or a complete denial of service. Go-based network services handling untrusted HTTP/2 traffic may experience elevated memory usage under sustained reset attacks, but typical deployments remain operational without catastrophic service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78663",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78663",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847187",
          "url": "https://go.dev/cl/847187"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847310",
          "url": "https://go.dev/cl/847310"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81743",
          "url": "https://go.dev/issue/81743"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6612",
          "url": "https://pkg.go.dev/vuln/GO-2026-6612"
        }
      ],
      "release_date": "2026-10-08T22:53:59.772000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server"
    },
    {
      "cve": "CVE-2026-78667",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:51.418048+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity for Red Hat products because an unauthenticated remote attacker can exhaust server compute resources over the network, leading to a complete service outage. Across Red Hat enterprise environments, Go is widely deployed in container runtimes, monitoring daemons, and OpenShift infrastructure components. However, exploitation is restricted to applications that actively listen on the network and serve content using standard library HTTP handlers that process multi-range requests. CLI utilities and server components that do not handle byte-range requests from untrusted clients remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78667",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847309",
          "url": "https://go.dev/cl/847309"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81858",
          "url": "https://go.dev/issue/81858"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6609",
          "url": "https://pkg.go.dev/vuln/GO-2026-6609"
        }
      ],
      "release_date": "2026-10-08T22:53:59.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers"
    },
    {
      "cve": "CVE-2026-78669",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:28.964317+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service.\n\nThis vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78669",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847186",
          "url": "https://go.dev/cl/847186"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847308",
          "url": "https://go.dev/cl/847308"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81742",
          "url": "https://go.dev/issue/81742"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6611",
          "url": "https://pkg.go.dev/vuln/GO-2026-6611"
        }
      ],
      "release_date": "2026-10-08T22:53:59.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "In case you consume HTTP2, upgrade to a patched version of the http module.\n\nVerify:\n```\ngo version\ngo list -m golang.org/x/net\ngovulncheck ./...\n```",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames"
    },
    {
      "cve": "CVE-2026-94439",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-08T23:00:55.470995+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate-impact flaw was found in the Go standard library net/http package, which is shipped in the golang and go-toolset components of Red Hat Enterprise Linux and used by many Go-based Red Hat products and components (including Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and bundled components such as osbuild-composer and rhc). When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve HTTP requests from a connection that should be treated as an opaque tunnel. A remote, unauthenticated attacker who can reach the server through an intermediate proxy that treats the connection as tunneled can exploit this desynchronization to conduct HTTP request smuggling, potentially bypassing proxy-enforced security controls and accessing requests or responses intended for other users. Red Hat rates this flaw Moderate severity (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting the limited confidentiality and integrity impact. Because the impact is Moderate with a CVSS score below 7.0, fixes for the affected Red Hat products are currently deferred rather than scheduled for an immediate update, and the Red Hat In-Vehicle OS 2.0.z streams are out of support scope. The residual risk of deferral is limited to HTTP request smuggling against servers that accept HTTP/1 CONNECT requests and are deployed behind an intermediate proxy.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94439",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847311",
          "url": "https://go.dev/cl/847311"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81744",
          "url": "https://go.dev/issue/81744"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6613",
          "url": "https://pkg.go.dev/vuln/GO-2026-6613"
        }
      ],
      "release_date": "2026-10-08T22:53:59.976000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses"
    },
    {
      "cve": "CVE-2026-94440",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:17.316758+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847307",
          "url": "https://go.dev/cl/847307"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81741",
          "url": "https://go.dev/issue/81741"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6608",
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "release_date": "2026-10-08T22:53:58.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing"
    },
    {
      "cve": "CVE-2026-94444",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-10-08T23:01:23.734635+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548343"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy (GOMODPROXY), the proxy can serve an arbitrary replacement module that still passes local verification. This can lead to arbitrary code execution during Go build or module download operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. Exploitation requires a developer to operate inside a maliciously crafted Go project and to use an untrusted module proxy. The golang toolchain is primarily a development and build-time component, and this is not a typical Red Hat product runtime configuration. Successful exploitation can result in arbitrary code execution as the user running the go command.\n\nGo versions before 1.24 do not include the bundled golang.org/fips140 module handling and are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94444"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548343",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548343"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94444",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94444"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94444",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94444"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/840685",
          "url": "https://go.dev/cl/840685"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81833",
          "url": "https://go.dev/issue/81833"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6601",
          "url": "https://pkg.go.dev/vuln/GO-2026-6601"
        }
      ],
      "release_date": "2026-10-08T22:53:57.787000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy"
    },
    {
      "cve": "CVE-2026-94447",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-10-08T23:01:20.452497+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548342"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go toolchain (cmd/go). When a user works inside a malicious Go project that forges a golang.org/toolchain go.sum entry and uses an untrusted Go module proxy, cmd/go can skip the canonical checksum database check for toolchain downloads. A tampered toolchain may then be downloaded and executed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate. Exploitation requires a developer to operate inside a maliciously crafted Go project and to use an untrusted module proxy. The golang toolchain is primarily a development and build-time component, and this is not a typical Red Hat product runtime configuration. Successful exploitation can result in execution of a tampered Go toolchain as the user running the go command.\n\nGo versions before 1.21 do not implement automatic golang.org/toolchain downloads and are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94447"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548342",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548342"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94447",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94447"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94447",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94447"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/840785",
          "url": "https://go.dev/cl/840785"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81834",
          "url": "https://go.dev/issue/81834"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6602",
          "url": "https://pkg.go.dev/vuln/GO-2026-6602"
        }
      ],
      "release_date": "2026-10-08T22:53:57.974000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: cmd/go: Toolchain checksum verification bypass via crafted project configuration"
    },
    {
      "cve": "CVE-2026-94448",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:36.563246+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548346"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user\u0027s browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A MODERATE severity cross-site scripting (XSS) vulnerability was found in Go\u0027s html/template package, which is shipped and used across multiple Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset), Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and other components that build against the Go toolchain. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state upon entering a new expression. As a result, subsequent regular expression literals are not accurately recognized and escaped, allowing a remote attacker to supply untrusted content through a template that bypasses html/template sanitization and executes malicious script in a victim\u0027s browser. Successful exploitation requires a victim user to visit a rendered page of a Go web application that interpolates attacker-controlled input into JavaScript template literals. Red Hat has rated this flaw MODERATE with a CVSS 3.1 score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream assessment; the impact is limited to low confidentiality and integrity loss within the client browser context, with no availability impact. Because the CVSS score is below 7.0, the fix is deferred for the affected Red Hat product streams and update trackers are not being filed for this MODERATE severity flaw at this time. The residual risk is limited to Go-based web applications that render attacker-controlled content through html/template into JavaScript contexts; the flaw does not affect applications that do not use html/template with JavaScript template literals.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548346",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548346"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94448",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94448",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/839866",
          "url": "https://go.dev/cl/839866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81821",
          "url": "https://go.dev/issue/81821"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6599",
          "url": "https://pkg.go.dev/vuln/GO-2026-6599"
        }
      ],
      "release_date": "2026-10-08T22:53:57.417000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals"
    },
    {
      "cve": "CVE-2026-97030",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:06.022541+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the \u0027yield\u0027 keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user\u0027s web browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/840925",
          "url": "https://go.dev/cl/840925"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81823",
          "url": "https://go.dev/issue/81823"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6600",
          "url": "https://pkg.go.dev/vuln/GO-2026-6600"
        }
      ],
      "release_date": "2026-10-08T22:53:57.597000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword"
    },
    {
      "cve": "CVE-2026-97031",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:59.284728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger memory exhaustion and crash server processes without requiring privileges or user interaction. Go applications that terminate TLS connections and accept Encrypted Client Hello configurations are vulnerable to resource amplification during the initial handshake. While the flaw does not facilitate arbitrary code execution or compromise data confidentiality, the resulting denial of service can disrupt critical network services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847312",
          "url": "https://go.dev/cl/847312"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81855",
          "url": "https://go.dev/issue/81855"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6607",
          "url": "https://pkg.go.dev/vuln/GO-2026-6607"
        }
      ],
      "release_date": "2026-10-08T22:53:58.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references"
    },
    {
      "cve": "CVE-2026-97032",
      "cwe": {
        "id": "CWE-366",
        "name": "Race Condition within a Thread"
      },
      "discovery_date": "2026-10-08T23:01:02.635561+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated with a Moderate severity for Red Hat products because, although remotely triggerable without authentication, successful exploitation relies on winning a race condition and causes only a denial of service without compromising system confidentiality or integrity. Within Red Hat environments, exposure is limited to network services and server applications built with the Go runtime that actively handle HTTP/2 connections. Applications communicating strictly over HTTP/1.1 or where client connections do not modify header compression parameters are not vulnerable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847188",
          "url": "https://go.dev/cl/847188"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847313",
          "url": "https://go.dev/cl/847313"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81867",
          "url": "https://go.dev/issue/81867"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6617",
          "url": "https://pkg.go.dev/vuln/GO-2026-6617"
        }
      ],
      "release_date": "2026-10-08T22:54:00.230000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients.\n\nFor applications managed by systemd, configure the environment variable by creating a service override:\n\nsystemctl edit \u003cservice-name\u003e\n\nAdd the following lines under the [Service] section:\n\n[Service]\nEnvironment=\"GODEBUG=http2server=0\"\n\nApply the changes and restart the daemon:\n\nsystemctl daemon-reload\nsystemctl restart \u003cservice-name\u003e\n\nTo limit network exposure using firewalld, restrict access to trusted networks:\n\nfirewall-cmd --zone=trusted --add-source=\u003ctrusted-ip-range\u003e --permanent\nfirewall-cmd --reload\n\nCaveats:\nDisabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC.\n\nWarning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-20T22:57:24+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:86196"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:go-toolset-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-docs-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-misc-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-src-0:1.26.10-1.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.