ALSA-2026:22112 — Important: go-toolset:rhel8 security update

Summary

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)
* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)
* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)
* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 9

Release	Package	Fixed in
AlmaLinux · 8	delve	1.25.2-1.module_el8.10.0+4074+24330916
AlmaLinux · 8	go-toolset	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-bin	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-docs	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-misc	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-race	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-src	1.25.10-1.module_el8.10.0+4187+c45165c4
AlmaLinux · 8	golang-tests	1.25.10-1.module_el8.10.0+4187+c45165c4

Vulnerabilities 13

High 7.5

CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
High 7.5

CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
High 7.5

CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
High 7.5

CVE-2026-39836

Panic in Dial and LookupPort when handling NUL byte on Windows in net

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
High 7.5

CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
High 7.5

CVE-2026-42501

Malicious module proxy can bypass checksum database in cmd/go

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious…

Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 6.1

CVE-2026-32289

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, le…

Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 6.1

CVE-2026-39823

Bypass of meta content URL escaping causes XSS in html/template

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…

Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 6.1

CVE-2026-39826

Escaper bypass leads to XSS in html/template

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 5.9

CVE-2026-39817

Invoking "go tool pack" does not sanitize output paths in cmd/go

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 5.5

CVE-2026-32288

Unbounded allocation for old GNU sparse in archive/tar

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Go standard library archive/tar golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 5.3

CVE-2026-39819

Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 5.3

CVE-2026-39825

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are…

Go standard library net/http/httputil golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-33811
report
https://access.redhat.com/security/cve/CVE-2026-33814
report
https://access.redhat.com/security/cve/CVE-2026-39817
report
https://access.redhat.com/security/cve/CVE-2026-39819
report
https://access.redhat.com/security/cve/CVE-2026-39820
report
https://access.redhat.com/security/cve/CVE-2026-39823
report
https://access.redhat.com/security/cve/CVE-2026-39825
report
https://access.redhat.com/security/cve/CVE-2026-39826
report
https://access.redhat.com/security/cve/CVE-2026-39836
report
https://access.redhat.com/security/cve/CVE-2026-42499
report
https://access.redhat.com/security/cve/CVE-2026-42501
report
https://bugzilla.redhat.com/2467822
advisory
https://errata.almalinux.org/8/ALSA-2026-22112.html
report
https://www.redhat.com/security/data/cve/CVE-2026-32288.html
report
https://www.redhat.com/security/data/cve/CVE-2026-32289.html

Important: go-toolset:rhel8 security update

Summary

Fixed packages 9

Vulnerabilities 13

Crash when handling long CNAME response in net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Quadratic string concatentation in consumeComment in net/mail

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Quadratic string concatenation in consumePhrase in net/mail

Malicious module proxy can bypass checksum database in cmd/go

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Bypass of meta content URL escaping causes XSS in html/template

Escaper bypass leads to XSS in html/template

Invoking "go tool pack" does not sanitize output paths in cmd/go

Unbounded allocation for old GNU sparse in archive/tar

Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

References