Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Linux systems with Go runtime could execute harmful code

published 2 months ago

Summary

Red Hat Linux distributions that include the Go programming language may be exposed to attacks that let an attacker run unwanted commands. The issue is fixed in the latest security patches released by Red Hat. Apply the updated Go packages as soon as possible to keep your systems safe.

What to do

Update redhat go-toolset to version 0:1.26.5-1.el9_2.
Update redhat golang to version 0:1.26.5-1.el9_2.
Update redhat golang-bin to version 0:1.26.5-1.el9_2.
Update redhat golang-docs to version 0:1.26.5-1.el9_2.
Update redhat golang-misc to version 0:1.26.5-1.el9_2.
Update redhat golang-race to version 0:1.26.5-1.el9_2.
Update redhat golang-src to version 0:1.26.5-1.el9_2.
Update redhat golang-tests to version 0:1.26.5-1.el9_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.2::appstream	redhat	go-toolset	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-bin	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-docs	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-misc	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-race	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-src	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2
Red Hat:rhel_e4s:9.2::appstream	redhat	golang-tests	< 0:1.26.5-1.el9_2 Fix: upgrade to 0:1.26.5-1.el9_2

Original advisory text

Red Hat Security Advisory: golang security update

References

https://access.redhat.com/errata/RHSA-2026:61253 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445345 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2456335 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467809 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467810 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467811 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467813 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467815 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467820 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467823 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467825 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467826 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480756 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484205 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484207 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2498152 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61253.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-27137 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27137 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-27137 Vendor Advisory
https://go.dev/cl/752182 Third Party Advisory
https://go.dev/issue/77952 Third Party Advisory
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4599 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-27145 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27145 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-27145 Vendor Advisory
https://go.dev/cl/783621 Third Party Advisory
https://go.dev/issue/79694 Third Party Advisory
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5037 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33810 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33810 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33810 Vendor Advisory
https://go.dev/cl/763763 Third Party Advisory
https://go.dev/issue/78332 Third Party Advisory
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4866 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33811 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33811 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33811 Vendor Advisory
https://go.dev/cl/767860 Third Party Advisory
https://go.dev/issue/78803 Third Party Advisory
https://groups.google.com/g/golang-announce/c/qcCIEXso47M Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4981 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33814 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33814 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33814 Vendor Advisory
https://go.dev/cl/761581 Third Party Advisory
https://go.dev/cl/761640 Third Party Advisory
https://go.dev/issue/78476 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4918 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39817 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39817 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39817 Vendor Advisory
https://go.dev/cl/767520 Third Party Advisory
https://go.dev/issue/78778 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4979 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39819 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39819 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39819 Vendor Advisory
https://go.dev/cl/763882 Third Party Advisory
https://go.dev/issue/78584 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4978 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39820 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39820 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39820 Vendor Advisory
https://go.dev/cl/759940 Third Party Advisory
https://go.dev/issue/78566 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4986 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39821 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39821 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39821 Vendor Advisory
https://go.dev/cl/767220 Third Party Advisory
https://go.dev/issue/78760 Third Party Advisory
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5026 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39822 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39822 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39822 Vendor Advisory
https://go.dev/cl/797880 Third Party Advisory
https://go.dev/issue/79005 Third Party Advisory
https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4970 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39823 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39823 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39823 Vendor Advisory
https://go.dev/cl/769920 Third Party Advisory
https://go.dev/issue/78913 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4982 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39825 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39825 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39825 Vendor Advisory
https://go.dev/cl/770541 Third Party Advisory
https://go.dev/issue/78948 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4976 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-39826 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-39826 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39826 Vendor Advisory
https://go.dev/cl/771180 Third Party Advisory
https://go.dev/issue/78981 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4980 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42499 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42499 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42499 Vendor Advisory
https://go.dev/cl/771520 Third Party Advisory
https://go.dev/issue/78987 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4977 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42501 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42501 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42501 Vendor Advisory
https://go.dev/cl/775321 Third Party Advisory
https://go.dev/issue/79070 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4984 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42507 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42507 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42507 Vendor Advisory
https://go.dev/cl/777060 Third Party Advisory
https://go.dev/issue/79346 Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-5039 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

8.8 High

Timeline

Published31 Aug 2026

Updated3 Sep 2026

First seen3 Sep 2026

Sources

RHSA-2026:61253 · OSV

Track software like this

Free during beta