Loading story…
Red Hat remediated CVE-2024-1394, a high-severity, network-exploitable denial-of-service flaw in the golang-fips/openssl RSA encryption and decryption implementation. Attacker-controlled inputs can trigger error paths in rsa.go that clear named return variables before deferred cleanup occurs, leaving OpenSSL pkey and ctx objects unreleased and causing memory exhaustion. Red Hat assigned a CVSS 3.1 score of 7.5 and classified the issue as CWE-401.
RHSA-2024:1472 provides updated Go Toolset and Golang packages for the go-toolset:rhel8 module on RHEL 8, including x86_64, s390x, ppc64le, aarch64, and specified RHEL 8.10 Extended Life Cycle environments. Red Hat advises affected organizations to apply the supplied updates; while many RHEL utilities have moderate practical exposure because they are short-lived command-line tools using the package only at build time, network-facing applications processing attacker-controlled RSA inputs may be susceptible to resource exhaustion.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:3265 for Grafana on Red Hat Enterprise Linux 8, updating Grafana to version 9.2.10-16.el8_10. The advisory remediates CVE-2024-1394 in golang-fips/openssl and CVE-2024-1313, a Grafana authorization-bypass vulnerability.
Red Hat issued RHSA-2024:1646, an Important security advisory updating Grafana on Red Hat Enterprise Linux 8 to version 9.2.10-8.el8_9. The update remediated the CVE-2024-1394 RSA encryption/decryption memory leak in golang-fips/openssl, including for RHEL 8.10 Extended Life Cycle deployments.
Red Hat issued RHSA-2024:1644, an Important security advisory, updating grafana-pcp on Red Hat Enterprise Linux 8 to version 5.1.1-2.el8_9. The update remediated CVE-2024-1394, an RSA encryption/decryption memory-leak flaw in golang-fips/openssl.
Red Hat released RHSA-2024:1640 to fix the affected receptor component in Red Hat Ansible Automation Platform 2.4 for RHEL 8 and RHEL 9.
Red Hat issued RHSA-2024:1472, an Important security advisory, updating the go-toolset:rhel8 module and Golang packages for Red Hat Enterprise Linux 8 to remediate the CVE-2024-1394 RSA memory-leak vulnerability.
Red Hat issued RHSA-2024:7262 to remediate CVE-2024-1394 in the osbuild-composer component for Red Hat Enterprise Linux 8.
Red Hat issued RHSA-2024:5258 to remediate CVE-2024-1394 in the container-tools:rhel8 component of Red Hat Enterprise Linux 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2026-32283**, an Important denial-of-service flaw in `crypto/tls` that can deadlock TLS 1.3 connections when a peer sends multiple post-handshake key update messages in a single record, leading to uncontrolled resource consumption. Go also disclosed **CVE-2026-27144** in `cmd/compile`, where a no-op interface conversion could bypass overlap checks for memory moves, creating conditions for unsafe overlapping copies and possible memory corruption or unexpected behavior at runtime. Red Hat subsequently shipped fixes for these Go flaws across multiple RHEL 8, 9, and 10 channels and dependent packages including **golang**, **rhc**, **ipp-usb**, **gvisor-tap-vsock**, and **Cryostat 4**, often alongside other Go vulnerabilities in `crypto/x509` and `internal/syscall/unix`. Advisories rated the updates **Important**, with `CVE-2026-32283` scored **CVSS 7.5** by Red Hat, and updated package builds were released for major architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x` across standard, EUS, AUS, SAP, and Extended Life Cycle offerings.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026