A critical privilege escalation vulnerability (CVE-2026-39821, CVSS 9.6) exists in the `golang.org/x/net/idna` package due to incorrect Punycode label processing, while a high-severity directory traversal vulnerability (CVE-2026-39822, CVSS 7.8) exists in the `os.Root` function via symlink following. The `golang net` package is affected in versions prior to 0.55.0. Red Hat has released an update for RHEL 9 containing Go version 1.26.5+1 to address these issues.
Red Hat Product Errata RHSA-2026:37435 - Security Advisory Issued: 2026-07-09 Updated: 2026-07-09 RHSA-2026:37435 - Security Advisory Overview Updated Packages Synopsis Important: golang security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The golang packages provide the Go programming language compiler. Security Fix(es): golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:RHEL-193476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing RHEL-193476 - Update Go to version 1.26.5+1 [rhel-9.8.z] CVEs CVE-2026-39821 CVE-2026-39822 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf x86_64 go-toolset-1.26.5-1.el9_8.x86_64.rpm SHA-256: 6fe04126a34d4802ec9271403682b126f8861d88aefec0ddbaca7da483bf39e8 golang-1.26.5-1.el9_8.x86_64.rpm SHA-256: ffb6333998d5c61e80202fe8fa5b427a8dbf126b2b5cebf4e687e269669c1dbe golang-bin-1.26.5-1.el9_8.x86_64.rpm SHA-256: f177bf6c26824c1a20693eb8e2d2a16b42977a7d9f3bd288b508afad65812564 golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.x86_64.rpm SHA-256: 00c68c81e26c9acc38d80b838f0e782bb587a28757e7f11ecd725c4499ea0777 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf x86_64 go-toolset-1.26.5-1.el9_8.x86_64.rpm SHA-256: 6fe04126a34d4802ec9271403682b126f8861d88aefec0ddbaca7da483bf39e8 golang-1.26.5-1.el9_8.x86_64.rpm SHA-256: ffb6333998d5c61e80202fe8fa5b427a8dbf126b2b5cebf4e687e269669c1dbe golang-bin-1.26.5-1.el9_8.x86_64.rpm SHA-256: f177bf6c26824c1a20693eb8e2d2a16b42977a7d9f3bd288b508afad65812564 golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.x86_64.rpm SHA-256: 00c68c81e26c9acc38d80b838f0e782bb587a28757e7f11ecd725c4499ea0777 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for IBM z Systems 9 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf s390x go-toolset-1.26.5-1.el9_8.s390x.rpm SHA-256: 157c5faa4d40c5890a19e27d6c3064f063eba47ca8b1f6a426627b6425d01321 golang-1.26.5-1.el9_8.s390x.rpm SHA-256: 5b8e471be65daee3807c8b4d0ecf2d74c31810fe77bd743a44604544efebf075 golang-bin-1.26.5-1.el9_8.s390x.rpm SHA-256: 50e9ffabb62ef294a14a96fa58cbc3dff1c78ed612d22fc9f1f2c3ffb94908ca golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.s390x.rpm SHA-256: e94275b37bb5e73b2fba01d15272ab89a1edbaccbe7853598afcaedfe10be7e5 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf s390x go-toolset-1.26.5-1.el9_8.s390x.rpm SHA-256: 157c5faa4d40c5890a19e27d6c3064f063eba47ca8b1f6a426627b6425d01321 golang-1.26.5-1.el9_8.s390x.rpm SHA-256: 5b8e471be65daee3807c8b4d0ecf2d74c31810fe77bd743a44604544efebf075 golang-bin-1.26.5-1.el9_8.s390x.rpm SHA-256: 50e9ffabb62ef294a14a96fa58cbc3dff1c78ed612d22fc9f1f2c3ffb94908ca golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.s390x.rpm SHA-256: e94275b37bb5e73b2fba01d15272ab89a1edbaccbe7853598afcaedfe10be7e5 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for Power, little endian 9 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf ppc64le go-toolset-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 9064749e7f12c74ec1cd5603ea42227f7ab850b30ab977f18a91f1b0bf917974 golang-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 5b1cacea443746d5c5cdfa02d867ec58d5a1f6a559fdf5b9d4afdcf085f9548b golang-bin-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 84d77e1d2e804e06840ef8039ab49f22f7f8cc688f2301d1090d5d705afab096 golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.ppc64le.rpm SHA-256: e2c691d291865cf6f46e91b170771493519efa6e250f0eaf51a6342f487a86b1 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf ppc64le go-toolset-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 9064749e7f12c74ec1cd5603ea42227f7ab850b30ab977f18a91f1b0bf917974 golang-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 5b1cacea443746d5c5cdfa02d867ec58d5a1f6a559fdf5b9d4afdcf085f9548b golang-bin-1.26.5-1.el9_8.ppc64le.rpm SHA-256: 84d77e1d2e804e06840ef8039ab49f22f7f8cc688f2301d1090d5d705afab096 golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241a403b78ef2d322220e6b3e14b5de94c21df7c284ed8ac0dac955e0a90 golang-misc-1.26.5-1.el9_8.noarch.rpm SHA-256: cda3966d53806d52079bc5f3468f5d15a68ac9be8c925d61ebcb58d3ecc7b33a golang-race-1.26.5-1.el9_8.ppc64le.rpm SHA-256: e2c691d291865cf6f46e91b170771493519efa6e250f0eaf51a6342f487a86b1 golang-src-1.26.5-1.el9_8.noarch.rpm SHA-256: 4fc1f95f29566904290cad635094a1d07c5dc3421c4d0f3fb8efebe18bde2bc0 golang-tests-1.26.5-1.el9_8.noarch.rpm SHA-256: c3d3c70fedb74b9eeb72e9095a35189a62a9fd98a3e184ee2700a3017de128df Red Hat Enterprise Linux for ARM 64 9 SRPM golang-1.26.5-1.el9_8.src.rpm SHA-256: 45d5f6cd4321709dd8c2f2c1deccd4727573af5da20d750439966f5c627b8acf aarch64 go-toolset-1.26.5-1.el9_8.aarch64.rpm SHA-256: 620f3204ee99c57a87354dfb2ba566b7c1d099915a67d80550fccdada823c2f6 golang-1.26.5-1.el9_8.aarch64.rpm SHA-256: 82f201dbf4dc69fb60a6c3d2a0a19823f64c6194a1d4cd1ed035dc2b90fb7558 golang-bin-1.26.5-1.el9_8.aarch64.rpm SHA-256: 79a9efc6c72b374e0355ae27ca6c15cff222a430e25399eb48a2d5b62043c3eb golang-docs-1.26.5-1.el9_8.noarch.rpm SHA-256: a22f241