Loading story…
Red Hat issued multiple Important advisories to remediate two Go denial-of-service vulnerabilities affecting RHEL and downstream products: CVE-2026-33811, a crash-causing flaw in Go's net package when LookupCNAME processes an excessively long CNAME response with the cgo DNS resolver, and CVE-2026-27145, a performance DoS issue in crypto/x509 hostname verification caused by excessive processing of DNS Subject Alternative Name entries. The flaws can be triggered by malicious DNS or certificate inputs and impact software built on vulnerable Go components, with fixes published for Red Hat Enterprise Linux 7, 8, 9, and 10 streams as well as Extended Update Support and Extended Lifecycle channels.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important advisory RHSA-2026:61313 for the rhc package on RHEL 10 and RHEL 10.0 EUS. The update fixes CVE-2026-33811, a Go net LookupCNAME denial-of-service flaw, and CVE-2026-33810, a Go crypto/x509 certificate-validation bypass.
Red Hat issued RHSA-2026:54168 for rhc-worker-playbook on RHEL 10.0 Extended Update Support, releasing version 0.2.3-6.el10_0 packages that fix CVE-2026-33811 and CVE-2026-27145.
Red Hat issued RHSA-2026:50319 for Ansible Automation Platform 2.5, including fixes for CVE-2026-33811 in automation-gateway-proxy and CVE-2026-27145 in receptor alongside other vulnerabilities.
Red Hat issued RHSA-2026:49703 for the delve package on RHEL 10.0 Extended Update Support, shipping delve 1.26.1-1.el10_0 and fixing CVE-2026-33811 and CVE-2026-27145.
Red Hat issued RHSA-2026:48151 for Cryostat 4 on RHEL 9, listing the cryostat-storage-rhel9 component as fixed for CVE-2026-33811. This adds a new affected Red Hat product receiving a security fix for the Go net LookupCNAME denial-of-service flaw.
Red Hat issued RHSA-2026:42946 for rhc-worker-playbook on RHEL 10, fixing both CVE-2026-33811 and CVE-2026-27145 in updated rhc-worker-playbook 0.2.10-1.el10_2 packages.
Red Hat issued RHSA-2026:39573 for yggdrasil in Red Hat Enterprise Linux 10, releasing yggdrasil 0.4.9.2-1.el10_2 and fixing CVE-2026-33811 alongside CVE-2026-39821 and CVE-2026-27145. The advisory was rated Important and applied across multiple RHEL 10 architectures and channels.
Red Hat issued RHSA-2026:38504 for the container-tools:rhel8 module in Red Hat Enterprise Linux 8, fixing CVE-2026-33811 alongside CVE-2026-39835 and CVE-2026-57231. The Important advisory released updated Podman, Buildah, Skopeo, and runc packages across multiple RHEL 8 architectures and Extended Life Cycle variants.
Red Hat's Bugzilla record says OSIDB Bzimport recorded the description for CVE-2026-33811, a Go net LookupCNAME denial-of-service flaw caused by a double-free on very long CNAME responses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages across **Red Hat Enterprise Linux 8, 9, and 10** to fix multiple vulnerabilities, led by `CVE-2025-61728`, a denial-of-service flaw in Go's `archive/zip` component. The bug stems from a super-linear file-name indexing algorithm that runs when a file in a ZIP archive is first opened, allowing a crafted archive to trigger excessive CPU consumption and make affected applications unavailable. Red Hat said the issue was addressed broadly across standard, Extended Update Support, SAP, AUS/TUS, and Extended Life Cycle channels, as well as products including **Cryostat 4 on RHEL 9** and multiple **OpenShift Container Platform** versions. The advisories also remediate `CVE-2025-61726` in `net/url`, which can cause memory exhaustion during query parsing, `CVE-2025-61732` in `cmd/cgo`, which could enable code smuggling through doc comments, and in several RHEL 9.6, 10.0, and 10.1 channels `CVE-2025-68121` in `crypto/tls`, involving unexpected session resumption. Updated packages include Go builds such as **`golang 1.25.7`** for newer RHEL 9 and 10 releases, alongside backported fixes in older supported streams including RHEL 8.6 and 8.8 toolsets and RHEL 9.0, 9.2, and 9.4 channels.
Aug 20, 2026