Loading story…
Red Hat released a broad set of Important security updates for Go and Go-based packages across RHEL 8, 9, and 10, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core golang and go-toolset:rhel8 updates moved affected platforms to fixed Go builds such as 1.25.9 variants, addressing CVEs including CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32282, and CVE-2026-32283. Red Hat said CVE-2026-27140 could allow arbitrary code execution during builds through malicious SWIG filenames containing cgo, a flaw it scored CVSS 9.0.
The fixes also cascaded into Red Hat packages that embed or depend on Go components, including osbuild-composer, go-fdo-client, go-fdo-server, yggdrasil, delve, gvisor-tap-vsock, and golang-github-openprinting-ipp-usb. Several advisories specifically remediated Go crypto/x509 and crypto/tls issues tied to certificate chain validation and building (CVE-2026-32280, CVE-2026-32281, CVE-2026-32283), net/url parsing flaws such as CVE-2026-25679, and the internal/syscall/unix Root.Chmod symlink issue (CVE-2026-32282). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:49838 for osbuild-composer on Red Hat Enterprise Linux 9, releasing version 165.1-4.el9_8. The update fixed CVE-2026-32281 and CVE-2026-32280 and also included bug fix RHEL-185745 for a bootupctl backend install --auto failure.
Red Hat issued RHSA-2026:49526 for osbuild-composer on Red Hat Enterprise Linux 10, releasing version 165.1-3.el10_2.1. The update addressed CVE-2026-32281 and CVE-2026-32280 across standard, EUS, 4-year, and ELC channels for RHEL 10.2.
Red Hat issued RHSA-2026:22709 for osbuild-composer on RHEL 9.6 channels, releasing version 132.2-7.el9_6. The update fixed CVE-2026-32282, CVE-2026-32283, and CVE-2026-32280 across multiple RHEL 9.6 support offerings.
Red Hat issued RHSA-2026:22141 for go-fdo-client and go-fdo-server on Red Hat Enterprise Linux 10. The update released go-fdo-client 1.0.0-4.el10_2 and go-fdo-server 1.0.1-2.el10_2 to fix CVE-2025-68121, CVE-2026-32281, CVE-2026-32282, and CVE-2026-32280.
Red Hat issued RHSA-2026:19750 for osbuild-composer on Red Hat Enterprise Linux 10.0, releasing version 134.1-7.el10_0. The update fixed CVE-2026-25679, CVE-2026-32282, CVE-2026-32283, and CVE-2026-32280.
Red Hat issued RHSA-2026:19049 for golang-github-openprinting-ipp-usb on Red Hat Enterprise Linux 10, releasing ipp-usb version 0.9.27-6.el10_2. The update addressed CVE-2026-27137 and CVE-2026-25679 across multiple architectures and support channels.
Red Hat issued RHSA-2026:17075 for yggdrasil on Red Hat Enterprise Linux 10, releasing version 0.4.8-5.el10_1. The update fixed CVE-2026-32282 and CVE-2026-32283 across standard, EUS, ELC, and CodeReady Linux Builder channels.
Red Hat issued RHSA-2026:16021 for golang packages in RHEL 9.6 channels, releasing golang version 1.25.9-1.el9_6. The update fixed CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32282, and CVE-2026-32283 across multiple RHEL 9.6 variants.
Red Hat issued RHSA-2026:10704 for the go-toolset:rhel8 module, updating Go Toolset to version 1.25.9+2 for RHEL 8.10.z. The advisory fixed six Go vulnerabilities including CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32282, and CVE-2026-32283.
Red Hat issued RHSA-2026:10217 for golang packages in Red Hat Enterprise Linux 10, updating Go to 1.25.9+2 and shipping golang/go-toolset packages version 1.25.9-3.el10_1. The advisory fixed CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32282, and CVE-2026-32283.
Red Hat issued RHSA-2026:9108 for gvisor-tap-vsock on RHEL 9.6 channels, releasing version 0.8.5-2.el9_6.1. The update addressed CVE-2025-61729, CVE-2025-61726, CVE-2025-68121, and CVE-2026-25679 across multiple RHEL 9.6 support streams and architectures.
Red Hat issued RHSA-2026:8842 for delve on Red Hat Enterprise Linux 10, releasing version 1.25.2-3.el10_1 to fix CVE-2026-27137 and CVE-2026-25679. The update covered standard, Extended Update Support, 4-year, and Extended Life Cycle channels.
Red Hat's Bugzilla entry states the CVE-2026-27140 issue was recorded in OSIDB, tracking the SWIG-related trust-layer bypass that can lead to code smuggling and arbitrary code execution at build time.
Red Hat's CVE entry for CVE-2026-27140 was made public, describing an arbitrary code execution flaw in Go and cmd/go exploitable through malicious SWIG file names. The issue was rated Important by Red Hat.
Red Hat's public CVE page for CVE-2026-27140 was updated, reflecting the vulnerability's status and linked fixes across Red Hat product streams.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
14 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages across **Red Hat Enterprise Linux 8, 9, and 10** to fix multiple vulnerabilities, led by `CVE-2025-61728`, a denial-of-service flaw in Go's `archive/zip` component. The bug stems from a super-linear file-name indexing algorithm that runs when a file in a ZIP archive is first opened, allowing a crafted archive to trigger excessive CPU consumption and make affected applications unavailable. Red Hat said the issue was addressed broadly across standard, Extended Update Support, SAP, AUS/TUS, and Extended Life Cycle channels, as well as products including **Cryostat 4 on RHEL 9** and multiple **OpenShift Container Platform** versions. The advisories also remediate `CVE-2025-61726` in `net/url`, which can cause memory exhaustion during query parsing, `CVE-2025-61732` in `cmd/cgo`, which could enable code smuggling through doc comments, and in several RHEL 9.6, 10.0, and 10.1 channels `CVE-2025-68121` in `crypto/tls`, involving unexpected session resumption. Updated packages include Go builds such as **`golang 1.25.7`** for newer RHEL 9 and 10 releases, alongside backported fixes in older supported streams including RHEL 8.6 and 8.8 toolsets and RHEL 9.0, 9.2, and 9.4 channels.
Aug 20, 2026
Red Hat released a broad set of **Important** security advisories for `rhc`, `image-builder`, and `delve` across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as `CVE-2025-61729`, `CVE-2025-61726`, and, in many newer builds, `CVE-2025-68121`. The affected software includes `rhc`, which connects systems to Red Hat hosted management services, `image-builder`, which creates customized OS artifacts, and `delve`, the Go debugger. Updated packages were issued for multiple architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels. The most prominent flaw, `CVE-2025-61729`, is rated **Important** by Red Hat with a CVSS 7.5 score and affects Go's `crypto/x509` handling through unbounded string concatenation in `HostnameError.Error()`, allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to **CWE-1050**. The related fixes also address `CVE-2025-61726`, a memory exhaustion issue in Go `net/url` query parsing, and `CVE-2025-68121`, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as `rhc` 0.2.x/0.3.x, `image-builder` 31-3/31-4, and `delve` 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Aug 20, 2026