Loading story…
Red Hat released RHSA-2026:48151 to patch Cryostat 4 on RHEL 9, rating the update Important and warning that the product bundled numerous vulnerable dependencies. The advisory covers a broad range of issues across components including Netty, Quarkus, Jackson Databind, Vert.x, several Go libraries, undici, ws, protobufjs, form-data, js-cookie, brace-expansion, and Avro decoders. Red Hat said the flaws could enable denial of service, information disclosure, data manipulation, authorization bypass, hostname verification bypass, man-in-the-middle attacks, cross-site scripting, integer overflow, prototype pollution, and arbitrary code execution.
One of the tracked issues, CVE-2026-42504, affected Go's MIME handling and could cause excessive CPU consumption when decoding a maliciously crafted MIME header with many invalid encoded words, resulting in a denial-of-service condition. Red Hat linked that bug directly to Cryostat 4 on RHEL 9 and said it was remediated through the same advisory, instructing customers to apply the update after confirming any prerequisite errata are already installed.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat's Bugzilla entry for CVE-2026-42504 describes a denial-of-service issue in Golang MIME header decoding caused by maliciously crafted headers with many invalid encoded-words. The notice says Cryostat 4 on RHEL 9 is affected and that the issue was addressed through advisory RHSA-2026:48151.
Red Hat published security advisory RHSA-2026:48151, rated Important, for the Red Hat build of Cryostat 4 on RHEL 9. The update addresses numerous bundled dependency vulnerabilities affecting components including Netty, Quarkus, Jackson Databind, Vert.x, Go libraries, undici, ws, protobufjs, form-data, js-cookie, brace-expansion, and Avro decoders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Go packages across **Red Hat Enterprise Linux 8, 9, and 10** to fix multiple vulnerabilities, led by `CVE-2025-61728`, a denial-of-service flaw in Go's `archive/zip` component. The bug stems from a super-linear file-name indexing algorithm that runs when a file in a ZIP archive is first opened, allowing a crafted archive to trigger excessive CPU consumption and make affected applications unavailable. Red Hat said the issue was addressed broadly across standard, Extended Update Support, SAP, AUS/TUS, and Extended Life Cycle channels, as well as products including **Cryostat 4 on RHEL 9** and multiple **OpenShift Container Platform** versions. The advisories also remediate `CVE-2025-61726` in `net/url`, which can cause memory exhaustion during query parsing, `CVE-2025-61732` in `cmd/cgo`, which could enable code smuggling through doc comments, and in several RHEL 9.6, 10.0, and 10.1 channels `CVE-2025-68121` in `crypto/tls`, involving unexpected session resumption. Updated packages include Go builds such as **`golang 1.25.7`** for newer RHEL 9 and 10 releases, alongside backported fixes in older supported streams including RHEL 8.6 and 8.8 toolsets and RHEL 9.0, 9.2, and 9.4 channels.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat issued multiple **Important** advisories to remediate two Go denial-of-service vulnerabilities affecting RHEL and downstream products: `CVE-2026-33811`, a crash-causing flaw in Go's `net` package when `LookupCNAME` processes an excessively long CNAME response with the cgo DNS resolver, and `CVE-2026-27145`, a performance DoS issue in `crypto/x509` hostname verification caused by excessive processing of DNS Subject Alternative Name entries. The flaws can be triggered by malicious DNS or certificate inputs and impact software built on vulnerable Go components, with fixes published for Red Hat Enterprise Linux 7, 8, 9, and 10 streams as well as Extended Update Support and Extended Lifecycle channels.
Sep 1, 2026