Loading story…
Red Hat disclosed and remediated CVE-2026-39820, a high-severity denial-of-service flaw in Go's net/mail package that can be triggered with crafted email input. The bug affects functions including ParseAddress, ParseAddressList, and ParseDate, where malicious input can drive excessive CPU consumption and memory allocation. Red Hat said the issue has been addressed across RHEL 8, 9, and 10, including RHEL 10.0 EUS and RHEL 9.6 EUS, following its original tracking in Bugzilla as bug 2467820.
On 2026-08-19, Red Hat shipped Important security updates for OpenShift Container Platform 4.19.43 and Red Hat build of MicroShift 4.19.43. Advisory RHSA-2026:54552 updated OpenShift packages and images to fix three Go denial-of-service issues—CVE-2026-33811 in net and CVE-2026-39820 plus CVE-2026-42499 in net/mail—while RHSA-2026:54883 delivered MicroShift RPM and image updates for CVE-2026-39820. Red Hat urged OpenShift and MicroShift 4.19 users on supported RHEL 8 and RHEL 9 platforms, including x86_64, ppc64le, s390x, and aarch64, to upgrade through the appropriate release channels and documented update procedures.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:60304 for RHEL 9, updating Go packages to version 1.26.7+1 for the 9.8.z stream. The Important advisory remediates six Go vulnerabilities, including denial-of-service issues in encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml, plus an html/template cross-site scripting flaw.
Red Hat published RHSA-2026:56852 for RHCOS systems running OpenShift Container Platform 4.16.69. The Important update remediates CVE-2026-39820 alongside Go flaws including CVE-2025-68121, CVE-2026-25679, CVE-2026-32280, CVE-2026-33811, and CVE-2026-42499.
Red Hat issued RHSA-2026:57914 for RHCOS 4 systems running Red Hat build of MicroShift 4.18.54. The Important-severity update remediates the Go net/mail denial-of-service flaws CVE-2026-39820 and CVE-2026-42499.
Red Hat published RHSA-2026:57845 for Red Hat Enterprise Linux CoreOS 4 systems using Red Hat build of MicroShift 4.16.69. The advisory updates MicroShift-related packages to remediate CVE-2026-39820 along with CVE-2026-33814, CVE-2026-39821, and CVE-2026-42499.
On 2026-08-19, Red Hat issued RHSA-2026:54883 for Red Hat build of MicroShift 4.19.43. The advisory delivers updated RPM packages and images to address CVE-2026-39820 and instructs MicroShift 4.19 users to apply the update.
On 2026-08-19, Red Hat issued RHSA-2026:54552 for Red Hat OpenShift Container Platform 4.19.43. The advisory includes fixes for CVE-2026-39820 in Go net/mail, alongside CVE-2026-33811 and CVE-2026-42499, and advises users to upgrade.
OSIDB Bzimport reported Bug 2467820 for CVE-2026-39820 on 2026-05-07. The bug tracks a high-severity denial-of-service flaw in Go's net/mail package triggered by crafted email inputs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released fixes for three Go standard-library denial-of-service vulnerabilities: **CVE-2024-34155** in `go/parser`, **CVE-2024-34156** in `encoding/gob`, and **CVE-2024-34158** in `go/build/constraint`. Applications that parse or decode attacker-controlled input can panic after deeply nested Go literals, gob structures, or legacy `// +build` expressions exhaust stack space. Red Hat rated the issues Important in affected product advisories; no exploitation evidence is identified in the supplied advisories. The fixes were delivered through updated Go toolsets for RHEL 8 and RHEL 9 and propagated to container tooling including Podman, Buildah, CRI-O, and the RHEL 8 container-tools module. Red Hat also issued updated images and packages for OpenShift Container Platform 4.12 through 4.17, OpenShift API for Data Protection, OpenStack Platform, Migration Toolkit for Containers, and several OpenShift operators. Organizations should update affected systems, container tools, and OpenShift clusters through their applicable Red Hat release channels, including all supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE deployments.
Aug 27, 2026
Red Hat released updates for **Red Hat Enterprise Linux 8** to fix `CVE-2021-46939`, a moderate-severity Linux kernel tracing flaw that can recursively acquire a spin lock when tracing is re-entered through the function graph tracer. A local attacker or user able to trigger the affected tracing conditions could cause a system deadlock and denial of service, including during suspend/resume testing. Red Hat rated the issue CVSS 5.5; RHEL 9 is not affected, while RHEL 6 and 7 are outside the affected support scope. Red Hat also issued **RHSA-2024:5439** for OpenShift Container Platform 4.15, delivering version 4.15.28 with updated container images and packages. The release remediates the Linux kernel route-management use-after-free vulnerability `CVE-2024-36971`, Go `net/http` memory-exhaustion flaw `CVE-2023-45290`, and Go `net/netip` IPv4-mapped IPv6 address-handling issue `CVE-2024-24790`; it also updates Kubernetes to 1.28.12. OpenShift 4.15 customers on x86_64, s390x, ppc64le, and aarch64 should upgrade through their supported release channel or the OpenShift web console.
Aug 26, 2026
Red Hat released security updates across **OpenShift Container Platform (OCP) 4.12 through 4.16** and OpenShift Serverless, remediating vulnerabilities in bundled Go, Linux kernel, glibc, OpenTelemetry, BIND, Ironic, Gunicorn, Werkzeug, and related components. The issues include HTTP/2 and multipart-form memory-exhaustion denial of service—such as `CVE-2023-45288` and `CVE-2023-45290`—sensitive URL data written to logs (`CVE-2024-6104`), cluster-monitoring credential leakage, unauthenticated local access and data exposure in OpenStack Ironic, and an SSH prefix-truncation attack. OpenShift 4.16.0 addressed 16 vulnerabilities, while the 4.14.39 update also fixed a glibc `iconv` out-of-bounds write that may allow remote code execution. Affected organizations should update OCP container images and packages through their supported release channels using the OpenShift CLI or web console, prioritizing deployed 4.12, 4.14, 4.15, and 4.16 clusters. The advisories cover RHEL 8 and RHEL 9 deployments across `x86_64`, `s390x`, `ppc64le`, and `aarch64` where applicable; OpenShift Serverless 1.33.0 also updates Serverless Operator components for OCP 4.12–4.16. Red Hat separately updated the RHEL 9 Go toolchain to version `golang-1.21.9-2.el9_4`, addressing HTTP processing, certificate-verification, redirect-forwarding, template escaping, and cryptographic flaws that affect Go-based workloads and platform components.
Aug 27, 2026