Loading story…
Red Hat released Important security updates for Go packages in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, addressing CVE-2026-27137 and CVE-2026-25679 across multiple architectures and support channels. The advisories, RHSA-2026:19181 for RHEL 9 and RHSA-2026:19022 for RHEL 10, update Go to 1.26.2+2 in the RHEL 9.8.z stream and 1.26.2-2.el10_2 in RHEL 10.2, with packages provided for x86_64, s390x, ppc64le, and aarch64 systems, including Extended Update Support and Extended Life Cycle offerings.
The more detailed flaw, CVE-2026-25679, affects Go's net/url.Parse function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue Important with a CVSS 7.5 score and said no qualifying mitigation was available, while the second bug, CVE-2026-27137, affects Go's crypto/x509 handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated golang and go-toolset packages to close both parsing and certificate-validation exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On May 19, 2026, Red Hat issued RHSA-2026:19022, an Important security advisory for golang packages in Red Hat Enterprise Linux 10. The update ships golang-1.26.2-2.el10_2, updates Go to version 1.26.2+2 for the RHEL 10.2.z stream, and fixes CVE-2026-27137 and CVE-2026-25679.
On May 19, 2026, Red Hat issued RHSA-2026:19181, an Important security advisory for golang packages in Red Hat Enterprise Linux 9. The update brings Go to version 1.26.2+2 for the RHEL 9.8.z stream and fixes CVE-2026-27137 and CVE-2026-25679 across multiple RHEL 9 variants and architectures.
Red Hat published its CVE page for CVE-2026-25679, documenting incorrect parsing of IPv6 host literals in Go's net/url.Parse and listing affected and fixed Red Hat components. The page rates the issue Important and maps it to CWE-1286.
Red Hat's CVE page for CVE-2026-25679 was last modified on March 19, 2026 at 10:34:02 AM UTC. The entry describes the issue as an Important-severity flaw with CVSS 7.5 and no qualifying mitigation available.
Red Hat's CVE entry states that CVE-2026-25679 was public on March 6, 2026. The flaw affects Go's net/url.Parse handling of malformed URLs with IPv6 host literals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026