Summary
The golang packages provide the Go programming language compiler.
Security Fix(es):
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | go-toolset | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-bin | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-docs | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-misc | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-race | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-src | 1.26.2-1.el9_8 |
| AlmaLinux · 9 | golang-tests | 1.26.2-1.el9_8 |
Vulnerabilities 3
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Incorrect enforcement of email constraints in crypto/x509
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…
-
High 7.5
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-25679
-
report
https://access.redhat.com/security/cve/CVE-2026-27137
-
report
https://bugzilla.redhat.com/2445345
-
report
https://bugzilla.redhat.com/2445356
-
advisory
https://errata.almalinux.org/9/ALSA-2026-19181.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-33810.html