Loading story…
Red Hat released Important security updates for Go across RHEL 8, RHEL 9, and RHEL 10, updating packages to Go 1.26.5+1 and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover CVE-2026-39821, a privilege-escalation flaw in golang.org/x/net/idna caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822,** a Unix os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on x86_64, s390x, ppc64le, and aarch64 systems.
The updates also include additional Go-related fixes depending on platform, including CVE-2026-42505 in crypto/tls, which can leak pre-shared key identities during Encrypted Client Hello (ECH) handshakes and allow passive observers to correlate connections, and CVE-2026-27145 on RHEL 8, described as a denial-of-service issue in crypto/x509. Red Hat rated CVE-2026-39821 at CVSS 8.2 and CVE-2026-39822 at CVSS 7.8, and said there is no mitigation for the os.Root flaw other than updating to fixed Go releases such as 1.25.12 or 1.26.5.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:47719 for golang packages in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related RHEL 9.2 channels, rated Important. The update brought Go to 1.25.9+2 and fixed CVE-2025-68121, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32280, CVE-2026-27144, and CVE-2026-27143.
Red Hat lists RHSA-2026:42078, RHSA-2026:42079, and RHSA-2026:42080 as fixing CVE-2026-39821 across Ansible Automation Platform 2.5, 2.6, and 2.7 receptor builds for RHEL 9 and RHEL 10, plus 2.5 for RHEL 8.
Red Hat published RHSA-2026:38995 for the go-toolset:rhel8 module on Red Hat Enterprise Linux 8, updating Go to 1.26.5+1 and fixing CVE-2026-39821, CVE-2026-27145, and CVE-2026-39822.
Red Hat published RHSA-2026:37436 for Red Hat Enterprise Linux 10, updating Go to 1.26.5+1 and fixing CVE-2026-39821 and CVE-2026-39822 while also listing CVE-2026-42505.
Red Hat published RHSA-2026:37435 for Red Hat Enterprise Linux 9, updating Go to 1.26.5+1 and fixing CVE-2026-39821 and CVE-2026-39822 while also listing CVE-2026-42505.
Red Hat states that CVE-2026-42505, a Moderate information disclosure flaw in Go crypto/tls affecting ECH handshakes, became public on this date.
Red Hat published its CVE entry for CVE-2026-39822, describing an Important-severity os.Root symlink-traversal flaw in Go on Unix systems and noting fixes in Go 1.25.12 and 1.26.5.
Red Hat lists RHSA-2026:35826 for grafana-pcp and RHSA-2026:35827 for grafana as fixes for CVE-2026-39821 in Red Hat Enterprise Linux 10.
Red Hat says RHSA-2026:34357 fixed CVE-2026-39821 in Red Hat Enterprise Linux 10 opentelemetry-collector.
Red Hat lists RHSA-2026:30855 as fixing CVE-2026-39821 for Red Hat Enterprise Linux 10 git-lfs, showing one of the earliest product remediations for the flaw.
Red Hat's CVE entry states that CVE-2026-39821, a privilege escalation flaw in golang.org/x/net/idna caused by incorrect Punycode label handling, became public on this date.
Red Hat published RHSA-2026:10219 for Red Hat Enterprise Linux 9, rating it Important and updating Go to version 1.25.9+2. The advisory fixed multiple Go vulnerabilities, including CVE-2026-32282, CVE-2026-32283, CVE-2026-32280, CVE-2026-27144, and CVE-2026-27143.
Red Hat states RHSA-2026:54773 fixed CVE-2026-42505 for OpenShift distributed tracing 3.10.1 components including opentelemetry-collector-rhel9 and opentelemetry-rhel9-operator.
Red Hat says RHSA-2026:48891 fixed CVE-2026-39822 in Red Hat Advanced Cluster Security for Kubernetes 4.11 rhacs-main-rhel9.
Red Hat published its CVE page for CVE-2026-39821, rating the flaw Important, assigning CVSS 8.2, and stating exposure spans products that ship the Go toolchain or bundle golang.org/x/net.
Red Hat's CVE-2026-39822 entry says RHSA-2026:38494 fixed RHEL 10 buildah, RHSA-2026:38493 fixed RHEL 9 buildah, and RHSA-2026:38878 fixed RHEL 9 podman for the os.Root flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages across **Red Hat Enterprise Linux 8, 9, and 10** to fix multiple vulnerabilities, led by `CVE-2025-61728`, a denial-of-service flaw in Go's `archive/zip` component. The bug stems from a super-linear file-name indexing algorithm that runs when a file in a ZIP archive is first opened, allowing a crafted archive to trigger excessive CPU consumption and make affected applications unavailable. Red Hat said the issue was addressed broadly across standard, Extended Update Support, SAP, AUS/TUS, and Extended Life Cycle channels, as well as products including **Cryostat 4 on RHEL 9** and multiple **OpenShift Container Platform** versions. The advisories also remediate `CVE-2025-61726` in `net/url`, which can cause memory exhaustion during query parsing, `CVE-2025-61732` in `cmd/cgo`, which could enable code smuggling through doc comments, and in several RHEL 9.6, 10.0, and 10.1 channels `CVE-2025-68121` in `crypto/tls`, involving unexpected session resumption. Updated packages include Go builds such as **`golang 1.25.7`** for newer RHEL 9 and 10 releases, alongside backported fixes in older supported streams including RHEL 8.6 and 8.8 toolsets and RHEL 9.0, 9.2, and 9.4 channels.
Aug 20, 2026