Loading story…
Red Hat disclosed and patched two medium-severity cross-site scripting flaws in Go's html/template package, tracked as CVE-2026-39823 and CVE-2026-39826. The bugs were reported on 2026-05-07 and affect template escaping logic in cases where developers rely on html/template to safely handle untrusted data in HTML output.
CVE-2026-39823 stems from improper URL escaping in a meta tag's content attribute when ASCII whitespace appears around the = character, which can let malicious input bypass protections and trigger XSS. CVE-2026-39826 affects escaping inside <script> tags when the type attribute is empty or contains ASCII whitespace, causing inserted data to be escaped incorrectly. Red Hat said fixes were released through multiple RHSA advisories for RHEL 8, 9, and 10, including RHEL 10.0 EUS and RHEL 9.6 EUS.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Rocky Linux published RLSA-2026:63332 for Rocky Linux 10 buildah packages, remediating seven Go standard-library flaws. The advisory includes CVE-2026-33810, a crypto/x509 certificate-validation bypass, plus XSS and denial-of-service issues including CVE-2026-42499 and CVE-2026-56858.
Red Hat published RHSA-2026:62754 to update RHEL 9 osbuild-composer packages, addressing seven Go standard-library denial-of-service flaws and the Go html/template XSS flaw CVE-2026-56858. The Important-rated advisory includes CVE-2026-42499 and CVE-2026-39820, among other vulnerabilities, affecting packages such as osbuild-composer-core, osbuild-composer-dnf-json, and osbuild-composer-worker.
Red Hat tracked CVE-2026-42499 as Bug 2467809 after OSIDB Bzimport reported a high-severity Go net/mail denial-of-service issue caused by pathological RFC 5322 email-address parsing in consumePhrase. Red Hat states the issue was addressed across RHEL 8, 9, and 10, RHEL EUS releases, and OpenShift Container Platform 4.19.
Red Hat's Bugzilla record says CVE-2026-39826, a Go html/template XSS issue caused by incorrect escaping inside script tags, was reported by OSIDB Bzimport. The report was tracked as Bug 2467826.
Red Hat's Bugzilla record says CVE-2026-39823, a Go html/template XSS issue involving improper URL escaping in a meta tag content attribute, was reported by OSIDB Bzimport. The report was tracked as Bug 2467811.
A Tenable reference identifies Red Hat Security Advisory RHSA-2026:57649 for RHEL 9 golang as associated with multiple Red Hat Bugzilla records, including 2467811 and 2467826. The provided notice does not specify the CVEs, fixed package version, or other technical remediation details.
Red Hat states both CVE-2026-39823 and CVE-2026-39826 were addressed in Red Hat Enterprise Linux 8, 9, 10, RHEL 10.0 Extended Update Support, and RHEL 9.6 Extended Update Support through advisories including RHSA-2026:22112, RHSA-2026:22120, RHSA-2026:22121, RHSA-2026:49702, and RHSA-2026:49712. The references do not explicitly anchor a date for when those advisories were issued.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated updates for Go and `osbuild-composer` across Red Hat Enterprise Linux 9 update channels. The Go update, `golang-1.26.5-1.el9_4` for RHEL 9.4, addresses 14 vulnerabilities involving denial of service, cross-site scripting (XSS), arbitrary file writes and overwrites, symlink-based directory traversal, checksum-validation bypasses, privilege escalation, and security-control bypasses. One tracked issue, **CVE-2026-39819**, allows the `go bug` command to write to predictable files in the system temporary directory; a local attacker able to create symlinks there could redirect those writes to an arbitrary target file. Separate `osbuild-composer` updates remediate flaws in Go's `golang.org/x/net` dependencies. RHSA-2026:59560 provides `osbuild-composer-132.2-11.el9_6` for RHEL 9.6, while RHSA-2026:59562 provides `osbuild-composer-101.3-4.el9_4.5` for RHEL 9.4 SAP Solution update services. The advisories address HTML parsing and rendering flaws—**CVE-2026-25681**, **CVE-2026-27136**, and **CVE-2026-42502**—that can enable XSS, including potential arbitrary code execution through XSS, plus **CVE-2026-39821** in the RHEL 9.4 package, involving improper Punycode-label processing that can enable privilege escalation. Organizations should apply the updated packages through their applicable RHEL, EUS, AUS, SAP, or Extended Life Cycle channels.
Aug 27, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026