Loading story…
Red Hat released Important security updates for image-builder on Red Hat Enterprise Linux 9 and RHEL 10, addressing eight vulnerabilities in bundled and dependent Go components. The flaws include CVE-2025-61726, a denial-of-service issue in Go's net/url form parsing that can exhaust memory through excessive unique query parameters, alongside CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-32282, CVE-2026-32283, CVE-2026-33186, and CVE-2026-34986. Red Hat said the affected issues span memory exhaustion, authorization bypass, denial of service, incorrect certificate or constraint validation, incorrect IPv6 parsing, and symlink-following behavior.
The updates apply to multiple RHEL product variants and architectures, including x86_64, s390x, ppc64le, and aarch64, as well as Extended Update Support, Extended Life Cycle, SAP, and 4-year support channels. Red Hat shipped fixed packages as image-builder-52.1-1.el9_8 for RHEL 9.8 and image-builder-52.1-1.el10_2 for RHEL 10. Related Red Hat advisories also patched Go-based packages such as ipp-usb and go-toolset, underscoring broader exposure to the net/url memory-exhaustion flaw and other Go security defects across the enterprise Linux portfolio.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat published an Important security advisory for image-builder on RHEL 9, releasing image-builder 52.1-1.el9_8. The update fixes the same eight Go-related bundled-component vulnerabilities across multiple RHEL 9.8 variants and architectures.
Red Hat published an Important security advisory for image-builder on RHEL 10, releasing image-builder 52.1-1.el10_2. The update fixes eight bundled-component vulnerabilities including CVE-2025-61726, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-32282, CVE-2026-32283, CVE-2026-33186, and CVE-2026-34986.
Red Hat published an Important security advisory for the go-toolset:rhel8 module affecting RHEL 8.4 support channels. The update fixes CVE-2025-61726 and CVE-2025-61732 and provides updated go-toolset and golang packages for x86_64.
Red Hat published a CVE page for CVE-2025-61726, rating the Go net/url denial-of-service issue Important with a CVSS v3.1 score of 7.5 and recommending package updates.
Red Hat listed RHSA-2026:3186 as fixing CVE-2025-61726 in Cryostat 4 on RHEL 9 components including cryostat-grafana-dashboard-rhel9, cryostat-rhel9-operator, and cryostat-storage-rhel9.
Red Hat published an Important security advisory for golang-github-openprinting-ipp-usb on RHEL 10, updating ipp-usb to 0.9.27-5.el10_1. The update fixes CVE-2025-61726 and CVE-2025-68121 across multiple RHEL 10 architectures and support channels.
Red Hat updated its CVE record for CVE-2025-61726, which it rates Important and says has no practical mitigation beyond updating affected packages.
Red Hat's CVE entry for CVE-2025-61726 was made public, describing a denial-of-service flaw in Go's net/url query parameter parsing that can cause excessive memory consumption.
Red Hat listed RHSA-2026:25089 as fixing CVE-2025-61726 in the hawtio-operator-container component of HawtIO 4.4.0.
Red Hat listed RHSA-2026:7942 as fixing CVE-2025-61726 in the hawtio-operator-container component of HawtIO 4.3.1.
Red Hat listed RHSA-2026:6278 as fixing CVE-2025-61726 in the automation-gateway-proxy component of Red Hat Ansible Automation Platform 2.5 for RHEL 8.
Red Hat listed RHSA-2026:4460 as fixing CVE-2025-61726 in receptor for Red Hat Ansible Automation Platform 2.4 on both RHEL 8 and RHEL 9.
Red Hat listed RHSA-2026:3959 as fixing CVE-2025-61726 in receptor for Red Hat Ansible Automation Platform 2.5 on both RHEL 8 and RHEL 9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat released a broad set of **Important** security advisories for `rhc`, `image-builder`, and `delve` across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as `CVE-2025-61729`, `CVE-2025-61726`, and, in many newer builds, `CVE-2025-68121`. The affected software includes `rhc`, which connects systems to Red Hat hosted management services, `image-builder`, which creates customized OS artifacts, and `delve`, the Go debugger. Updated packages were issued for multiple architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels. The most prominent flaw, `CVE-2025-61729`, is rated **Important** by Red Hat with a CVSS 7.5 score and affects Go's `crypto/x509` handling through unbounded string concatenation in `HostnameError.Error()`, allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to **CWE-1050**. The related fixes also address `CVE-2025-61726`, a memory exhaustion issue in Go `net/url` query parsing, and `CVE-2025-68121`, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as `rhc` 0.2.x/0.3.x, `image-builder` 31-3/31-4, and `delve` 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Aug 20, 2026