Loading story…
Red Hat disclosed and remediated CVE-2026-42507, a moderate-severity flaw in Golang's net/textproto package that allows attacker-controlled input to appear in returned error messages. The issue can inject misleading content into printed errors or logs, creating opportunities for operator confusion, log forgery, and misinterpretation of system events. Red Hat maps the bug to CWE-117 and assigns it a CVSS v3 score of 5.3, while noting that no acceptable mitigation is currently available under its product security criteria.
Red Hat said fixes were shipped through errata affecting multiple product lines, including Red Hat Enterprise Linux 8, 9, and 10, RHEL 9/10 Extended Update Support variants, Red Hat Hardened Images, and OpenShift distributed tracing components. Advisory RHSA-2026:29980 delivers updated Golang packages for RHEL 10 and moves Go to 1.26.4+1 in the 10.2.z stream, with coverage across architectures including x86_64, s390x, ppc64le, and aarch64; the advisory also references CVE-2026-27145 and CVE-2026-42504.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued advisory RHSA-2026:29981 to address CVE-2026-42507 in Red Hat Enterprise Linux 9. Red Hat's Bugzilla and CVE records both list RHEL 9 as fixed through this advisory.
Red Hat published RHSA-2026:29980 for golang packages in Red Hat Enterprise Linux 10, fixing CVE-2026-42507 and updating Go to version 1.26.4+1 for the RHEL 10.2.z stream. The advisory rated the security impact as Moderate.
Red Hat issued advisories RHSA-2026:23262 and RHSA-2026:23264 to fix CVE-2026-42507 in Red Hat Hardened Images for golang1-25-main and golang1-26-main. The products were listed as fixed in Red Hat's CVE record.
Red Hat made public its CVE record for CVE-2026-42504, an Important-severity denial-of-service flaw in Golang's MIME package where malformed MIME headers with many invalid encoded-words can cause excessive CPU consumption. The entry also documented mitigations and tracked affected Red Hat products.
Red Hat tracked CVE-2026-42507 as Bugzilla issue 2484205, classifying it as a medium-severity vulnerability affecting Golang's net/textproto package. The report noted that attacker-controlled input could be included in returned error messages.
Red Hat's CVE record for CVE-2026-42507 was made public, describing a Golang net/textproto flaw where returned errors include attacker-controlled input. The issue was associated with misleading or forged log and error output.
A public Go security issue was opened for CVE-2026-42507 in net/textproto, describing that attacker-controlled input could be included in error messages without escaping and lead to misleading or log-injected output. The issue noted planned fixes on the Go 1.25 and 1.26 release branches.
Red Hat issued RHSA-2026:38995 to fix CVE-2026-42507 in Red Hat Enterprise Linux 8's go-toolset:rhel8 component. The Red Hat CVE record lists RHEL 8 as fixed through this advisory.
Red Hat issued RHSA-2026:33612 for OpenShift distributed tracing 3.10.1 components affected by CVE-2026-42507, including multiple tempo-related images and bundles. The CVE record lists these components as fixed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026