Loading story…
Go disclosed CVE-2026-32283, an Important denial-of-service flaw in crypto/tls that can deadlock TLS 1.3 connections when a peer sends multiple post-handshake key update messages in a single record, leading to uncontrolled resource consumption. Go also disclosed CVE-2026-27144 in cmd/compile, where a no-op interface conversion could bypass overlap checks for memory moves, creating conditions for unsafe overlapping copies and possible memory corruption or unexpected behavior at runtime.
Red Hat subsequently shipped fixes for these Go flaws across multiple RHEL 8, 9, and 10 channels and dependent packages including golang, rhc, ipp-usb, gvisor-tap-vsock, and Cryostat 4, often alongside other Go vulnerabilities in crypto/x509 and internal/syscall/unix. Advisories rated the updates Important, with CVE-2026-32283 scored CVSS 7.5 by Red Hat, and updated package builds were released for major architectures including x86_64, aarch64, ppc64le, and s390x across standard, EUS, AUS, SAP, and Extended Life Cycle offerings.
See real exploitation activity before you spend the cycle.
22 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:49600 on August 3, 2026 for rhc on RHEL 9.2 channels, releasing rhc 0.2.2-1.el9_2.3. The advisory fixed CVE-2026-32283 together with CVE-2025-68121, CVE-2026-32281, CVE-2026-32282, and CVE-2026-32280.
Red Hat published RHSA-2026:47712 on July 29, 2026 for golang packages in RHEL 9.4 channels, updating Go to 1.25.9+2 [rhel-9.4.z]. The advisory fixed CVE-2026-27144, CVE-2026-32283, and several other Go vulnerabilities.
Red Hat published RHSA-2026:28038 on June 22, 2026 for gvisor-tap-vsock on RHEL 9.6 Extended Update Support. The update released version 0.8.5-2.el9_6.2 and fixed CVE-2026-32283, CVE-2026-32282, CVE-2026-32280, and CVE-2026-27137.
Red Hat published RHSA-2026:24337 on June 8, 2026 for rhc on RHEL 9.6 Extended Update Support. The update released rhc 0.2.7-1.el9_6.4 and fixed CVE-2026-32283 along with CVE-2026-32281, CVE-2026-32282, and CVE-2026-32280.
Red Hat published RHSA-2026:22713 on June 3, 2026 for rhc on RHEL 10.0, releasing rhc 0.3.2-4.el10_0. The advisory explicitly fixed CVE-2026-32283 and CVE-2026-32280.
Red Hat published RHSA-2026:19550 on May 20, 2026 for golang-github-openprinting-ipp-usb in RHEL 10.0 channels. The update released ipp-usb 0.9.27-3.el10_0.4 and fixed CVE-2026-32283, CVE-2026-32282, and CVE-2026-32280.
Red Hat published RHSA-2026:19369 on May 19, 2026 for rhc on RHEL 9, releasing rhc 0.2.7-6.el9_8. The advisory fixed CVE-2026-32283 and CVE-2026-32282 for multiple RHEL 9 variants.
Red Hat published RHSA-2026:19156 on May 19, 2026 for rhc on RHEL 10, releasing rhc 0.3.8-4.el10_2. The advisory fixed CVE-2026-32283 and CVE-2026-32282 across multiple RHEL 10 architectures and support channels.
Red Hat published RHSA-2026:19144 on May 19, 2026 for golang-github-openprinting-ipp-usb on RHEL 10, releasing ipp-usb 0.9.27-7.el10_2. The update fixed CVE-2026-32283 together with CVE-2026-33810, CVE-2026-32282, and CVE-2026-32280.
Red Hat published RHSA-2026:17084 on May 13, 2026 for gvisor-tap-vsock on RHEL 10.0. The update shipped version 0.8.5-2.el10_0.1 and fixed CVE-2026-32283, CVE-2026-32282, CVE-2026-32280, and additional Go vulnerabilities.
Red Hat published RHSA-2026:15980 on May 11, 2026 for rhc on RHEL 8. The update released rhc 0.2.5-7.el8_10 and fixed CVE-2026-32283 along with CVE-2026-32282 and CVE-2026-32280.
Red Hat published RHSA-2026:16024 on May 11, 2026 for golang packages on RHEL 10.0, shipping golang 1.25.9-1.el10_0 and fixing CVE-2026-32283, CVE-2026-32282, CVE-2026-32280, CVE-2026-27144, and other Go vulnerabilities.
Red Hat published its CVE page for CVE-2026-32283 on May 6, 2026, rating the issue Important with a CVSS 7.5 score. The entry describes a crypto/tls TLS 1.3 denial-of-service flaw caused by multiple key update messages in a single record.
Red Hat published RHSA-2026:14391 on May 6, 2026 for the Red Hat build of Cryostat 4 on RHEL 9. The advisory fixed CVE-2026-32283 in Go crypto/tls along with several other Go vulnerabilities.
Red Hat published its CVE page for CVE-2026-27144 on April 23, 2026. The entry rated the issue Moderate and documented exploit conditions, impact, and fixed product mappings.
Red Hat lists RHSA-2026:10217 as fixing CVE-2026-27144 for Red Hat Enterprise Linux 10 golang on April 23, 2026. This was one of the first downstream product fixes referenced for the compiler flaw.
Red Hat recorded CVE-2026-27144 as Bugzilla 2456340 on April 8, 2026, classifying it with medium severity and priority. The bug tracks the Go compiler overlap-check bypass issue across affected Red Hat products.
Red Hat marked CVE-2026-27144 public on April 8, 2026. Its advisory describes a cmd/compile flaw where a no-op interface conversion can bypass overlap checking and potentially cause data corruption, memory corruption, or unexpected behavior.
Go opened private issue 78371 on March 25, 2026 for CVE-2026-27144, reported by Jakub Ciolek. The compiler bug failed to unwrap pointers inside a no-op interface conversion, which could misclassify overlapping moves as non-overlapping and allow unsafe move operations.
Go opened private issue 78334 for CVE-2026-32283 on March 24, 2026. The flaw affects TLS 1.3 connections and can deadlock a connection when multiple post-handshake key update messages are sent in a single record, leading to uncontrolled resource consumption and denial of service.
Red Hat lists RHSA-2026:10704 as fixing CVE-2026-27144 for Red Hat Enterprise Linux 8 go-toolset on April 27, 2026. This expanded fixes for the compiler flaw to RHEL 8.
Red Hat lists RHSA-2026:10219 as fixing CVE-2026-27144 for Red Hat Enterprise Linux 9 golang on April 24, 2026. The erratum extended downstream coverage of the Go compiler flaw to RHEL 9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcego.dev
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released multiple **Important** security advisories for `containernetworking-plugins`, `skopeo`, and `git-lfs` across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address `CVE-2025-61729` in Go's `crypto/x509`, `CVE-2025-61726` in `net/url` query parsing, and `CVE-2025-68121` in `crypto/tls`; newer `containernetworking-plugins` advisories also include `CVE-2026-25679`, an IPv6 host literal parsing flaw in `net/url`. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Upstream Go disclosures show the most prominent issue, `CVE-2025-61729`, can drive excessive CPU use during certificate hostname verification through inefficient handling in `crypto/x509`, including repeated hostname splitting and costly string processing in verification paths such as `Certificate.Verify` and `VerifyHostname`. Red Hat shipped fixed builds including `containernetworking-plugins` `1.7.1-3.el9_7`, `1.6.2-3.el9_6`, and `1.2.0-3.el9_2.3`, `skopeo` `1.20.0-3.el10_1`, and `git-lfs` `3.6.1-2.el10_0.2`, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Aug 20, 2026