Red Hat Product Errata RHSA-2026:61253 - Security Advisory Issued: 2026-08-31 Updated: 2026-08-31 RHSA-2026:61253 - Security Advisory Overview Updated Packages Synopsis Important: golang security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The golang packages provide the Go programming language compiler. Security Fix(es): crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2445345 - CVE-2026-27137 crypto/x509: Incorrect enforcement of email constraints in crypto/x509 BZ - 2456335 - CVE-2026-33810 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application BZ - 2467809 - CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing BZ - 2467810 - CVE-2026-42501 cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy BZ - 2467811 - CVE-2026-39823 html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content BZ - 2467813 - CVE-2026-39819 cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack BZ - 2467815 - CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame BZ - 2467820 - CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME BZ - 2467823 - CVE-2026-39825 net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls BZ - 2467825 - CVE-2026-39817 cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction BZ - 2467826 - CVE-2026-39826 html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2484205 - CVE-2026-42507 net/textproto: golang: Golang net/textproto: Misleading error messages via input injection BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries BZ - 2498152 - CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal CVEs CVE-2026-27137 CVE-2026-27145 CVE-2026-33810 CVE-2026-33811 CVE-2026-33814 CVE-2026-39817 CVE-2026-39819 CVE-2026-39820 CVE-2026-39821 CVE-2026-39822 CVE-2026-39823 CVE-2026-39825 CVE-2026-39826 CVE-2026-42499 CVE-2026-42501 CVE-2026-42507 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM golang-1.26.5-1.el9_2.src.rpm SHA-256: 4ec68393dedf842c237bcfeb801f93fd0b5e83b5be752f20e7c6bcf3d6b37b62 x86_64 go-toolset-1.26.5-1.el9_2.x86_64.rpm SHA-256: de27b5d21d1adb6591d86be9cf8e41a2b79685d599f14bc8a615d6b11946e13b golang-1.26.5-1.el9_2.x86_64.rpm SHA-256: 73718794ab7a7a90792c8ded1659b417c5072b4bcd53e503d749d37a331b3316 golang-bin-1.26.5-1.el9_2.x86_64.rpm SHA-256: 5eae55345c5e99c7316da216a20717aca00860c6fb4347abb63c082f43f29f79 golang-docs-1.26.5-1.el9_2.noarch.rpm SHA-256: 7866fd4545c11c89790152bbe2d12b1b441a9f667e5d4069ce3d22bd9a58ba65 golang-misc-1.26.5-1.el9_2.noarch.rpm SHA-256: f1d4e2e3a6cb21d1add1261d4cd626f100a92ddeb4b07158f50fb381ddd9cc7e golang-race-1.26.5-1.el9_2.x86_64.rpm SHA-256: 721fe4d41fc5c5198e0d781d123b8d90d46b9d90c26ab7eb316a56a354350bf6 golang-src-1.26.5-1.el9_2.noarch.rpm SHA-256: a9b6954abce74742cea1662c99476ddd9a9222f9416762cf65f72e03d38a4f52 golang-tests-1.26.5-1.el9_2.noarch.rpm SHA-256: 773912f634aa27ece922ab2583e2149d40ba5a51c9164360535c073a8c59aabd Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM golang-1.26.5-1.el9_2.src.rpm SHA-256: 4ec68393dedf842c237bcfeb801f93fd0b5e83b5be752f20e7c6bcf3d6b37b62 ppc64le go-toolset-1.26.5-1.el9_2.ppc64le.rpm SHA-256: f70bec003253e63ee076b9feb14bd21f74a372486e4ed614c3e68f9f80d2593a golang-1.26.5-1.el9_2.ppc64le.rpm SHA-256: 46a6e434888722e99115ae277a2135941f710a1e56aa48da912df2530dc4f05d golang-bin-1.26.5-1.el9_2.ppc64le.rpm SHA-256: ffa68b20cb5c97f9a723b3ceef1929002101027a90026098305b4ee58c142aa3 golang-docs-1.26.5-1.el9_2.noarch.rpm SHA-256: 7866fd4545c11c89790152bbe2d12b1b441a9f667e5d4069ce3d22bd9a58ba65 golang-misc-1.26.5-1.el9_2.noarch.rpm SHA-256: f1d4e2e3a6cb21d1add1261d4cd626f100a92ddeb4b07158f50fb381ddd9cc7e golang-race-1.26.5-1.el9_2.ppc64le.rpm SHA-256: a74b39ddc93dc7d57f56b24e400c0fbec06ec77f0c37a80093a6d06bd2a9c5f2 golang-src-1.26.5-1.el9_2.noarch.rpm SHA-256: a9b6954abce74742cea1662c99476ddd9a9222f9416762cf65f72e03d38a4f52 golang-tests-1.26.5-1.el9_2.noarch.rpm SHA-256: 773912f634aa27ece922ab2583e2149d40ba5a51c9164360535c073a8c59aabd Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM golang-1.26.5-1.el9_2.src.rpm SHA-256: 4ec68393dedf842c237bcfeb801f93fd0b5e83b5be752f20e7c6bcf3d6b37b62 x86_64 go-toolset-1.26.5-1.el9_2.x86_64.rpm SHA-256: de27b5d21d1adb6591d86be9cf8e41a2b79685d599f14bc8a615d6b11946e13b golang-1.26.5-1.el9_2.x86_64.rpm SHA-256: 73718794ab7a7a90792c8ded1659b417c5072b4bcd53e503d749d37a331b3316 golang-bin-1.26.5-1.el9_2.x86_64.rpm SHA-256: 5eae55345c5e99c7316da216a20717aca00860c6fb4347abb63c082f43f29f79 golang-docs-1.26.5-1.el9_2.noarch.rpm SHA-256: 7866fd4545c11c89790152bbe2d12b1b441a9f667e5d4069ce3d22bd9a58ba65 golang-misc-1.26.5-1.el9_2.noarch.rpm SHA-256: f1d4e2e3a6cb21d1add1261d4cd626f100a92ddeb4b07158f50fb381ddd9cc7e golang-race-1.26.5-1.el9_2.x86_64.rpm SHA-256: 721fe4d41fc5c5198e0d781d123b8d90d46b9d90c26ab7eb316a56a354350bf6 golang-src-1.26.5-1.el9_2.noarch.rpm SHA-256: a9b6954abce74742cea1662c99476ddd9a9222f9416762cf65f72e03d38a4f52 golang-tests-1.26.5-1.el9_2.noarch.rpm SHA-256: 773912f634aa27ece922ab2583e2149d40ba5a51c9164360535c073a8c59aabd Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 SRPM golang-1.26.5-1.el9_2.src.rpm SHA-256: 4ec68393dedf842c237bcfeb801f93fd0b5e83b5be752f20e7c6bcf3d6b37b62 aarch64 go-toolset-1.26.5-1.el9_2.aarch64.rpm SHA-256: 2a546c0274b67189a8a6ccf2dfb5ac17e4ef7fe86b0e09a0f9fd837123cca397 golang-1.26.5-1.el9_2.aarch64.rpm SHA-256: d2b99fdce7f0241f45ba60e8c22c4f718e092bff3f4f56179f13201a8ff4c68f golang-bin-1.26.5-1.el9_2.aarch64.rpm SHA-256: 6b8119cb6bc163de9d1c38602f57e803552397b5ddacbea82b070b156ce5ec70 golang-docs-1.26.5-1.el9_2.noarch.rpm SHA-256: 7866fd4545c11c89790152bbe2d12b1b441a9f6