Loading story…
Red Hat released Important-rated updates for Go and osbuild-composer across Red Hat Enterprise Linux 9 update channels. The Go update, golang-1.26.5-1.el9_4 for RHEL 9.4, addresses 14 vulnerabilities involving denial of service, cross-site scripting (XSS), arbitrary file writes and overwrites, symlink-based directory traversal, checksum-validation bypasses, privilege escalation, and security-control bypasses. One tracked issue, CVE-2026-39819, allows the go bug command to write to predictable files in the system temporary directory; a local attacker able to create symlinks there could redirect those writes to an arbitrary target file.
Separate osbuild-composer updates remediate flaws in Go's golang.org/x/net dependencies. RHSA-2026:59560 provides osbuild-composer-132.2-11.el9_6 for RHEL 9.6, while RHSA-2026:59562 provides osbuild-composer-101.3-4.el9_4.5 for RHEL 9.4 SAP Solution update services. The advisories address HTML parsing and rendering flaws—CVE-2026-25681, CVE-2026-27136, and CVE-2026-42502—that can enable XSS, including potential arbitrary code execution through XSS, plus CVE-2026-39821 in the RHEL 9.4 package, involving improper Punycode-label processing that can enable privilege escalation. Organizations should apply the updated packages through their applicable RHEL, EUS, AUS, SAP, or Extended Life Cycle channels.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2026:59560 for osbuild-composer across affected RHEL 9.6 offerings. The osbuild-composer-132.2-11.el9_6 update fixes golang.org/x/net/html vulnerabilities CVE-2026-27136, CVE-2026-25681, and CVE-2026-42502.
Red Hat issued Important-rated RHSA-2026:59562 for osbuild-composer on RHEL 9.4 Update Services for SAP Solutions. The osbuild-composer 101.3-4.el9_4.5 update fixes CVE-2026-39821 and three golang.org/x/net/html XSS-related flaws: CVE-2026-27136, CVE-2026-25681, and CVE-2026-42502.
Red Hat issued Important-rated RHSA-2026:57649, supplying Go 1.26.5-1.el9_4 for RHEL 9.4 update channels. The update remediates 14 CVEs, including CVE-2026-39819, covering issues such as denial of service, XSS, arbitrary file write, symlink traversal, integrity bypass, privilege escalation, and security-control bypass.
Red Hat addressed CVE-2026-56858, in which pathological input could prematurely close an unescaped forward slash and permit attacker-controlled content injection, potentially causing cross-site scripting. Fixes were issued for RHEL 8, 9, and 10 through RHSA-2026:60305, RHSA-2026:60304, and RHSA-2026:60306, respectively.
Red Hat documented CVE-2026-39819, in which the Go "go bug" command writes predictable temporary-file names that an attacker can pre-create as symlinks to overwrite another file. Red Hat stated that fixes were available for RHEL 8, 9, 10, RHEL 10.0 EUS, and RHEL 9.6 EUS through associated RHSA advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go across **RHEL 8, RHEL 9, and RHEL 10**, updating packages to **Go `1.26.5+1`** and addressing multiple vulnerabilities in the toolchain and bundled libraries. The advisories cover **CVE-2026-39821**, a privilege-escalation flaw in `golang.org/x/net/idna` caused by incorrect Punycode label handling that can bypass ASCII-only authorization checks, and **CVE-2026-39822`,** a Unix `os.Root` symlink-following bug that can enable directory traversal outside an intended root. Red Hat said the fixes apply across standard, extended support, and lifecycle variants on **x86_64, s390x, ppc64le, and aarch64** systems. The updates also include additional Go-related fixes depending on platform, including **CVE-2026-42505** in `crypto/tls`, which can leak pre-shared key identities during **Encrypted Client Hello (ECH)** handshakes and allow passive observers to correlate connections, and **CVE-2026-27145** on RHEL 8, described as a denial-of-service issue in `crypto/x509`. Red Hat rated **CVE-2026-39821** at **CVSS 8.2** and **CVE-2026-39822** at **CVSS 7.8**, and said there is no mitigation for the `os.Root` flaw other than updating to fixed Go releases such as **`1.25.12`** or **`1.26.5`**.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026