Summary
The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)
* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)
* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)
* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | go-toolset | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-bin | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-docs | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-misc | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-race | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-src | 1.26.3-1.el9_8 |
| AlmaLinux · 9 | golang-tests | 1.26.3-1.el9_8 |
Vulnerabilities 11
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
-
High 7.5
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
-
High 7.5
Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
-
High 7.5
Panic in Dial and LookupPort when handling NUL byte on Windows in net
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
-
High 7.5
Quadratic string concatenation in consumePhrase in net/mail
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
-
High 7.5
Malicious module proxy can bypass checksum database in cmd/go
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious…
-
Medium 6.1
Bypass of meta content URL escaping causes XSS in html/template
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…
-
Medium 6.1
Escaper bypass leads to XSS in html/template
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
-
Medium 5.9
Invoking "go tool pack" does not sanitize output paths in cmd/go
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…
-
Medium 5.3
Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…
-
Medium 5.3
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-33811
-
report
https://access.redhat.com/security/cve/CVE-2026-33814
-
report
https://access.redhat.com/security/cve/CVE-2026-39817
-
report
https://access.redhat.com/security/cve/CVE-2026-39819
-
report
https://access.redhat.com/security/cve/CVE-2026-39820
-
report
https://access.redhat.com/security/cve/CVE-2026-39823
-
report
https://access.redhat.com/security/cve/CVE-2026-39825
-
report
https://access.redhat.com/security/cve/CVE-2026-39826
-
report
https://access.redhat.com/security/cve/CVE-2026-39836
-
report
https://access.redhat.com/security/cve/CVE-2026-42499
-
report
https://access.redhat.com/security/cve/CVE-2026-42501
-
report
https://bugzilla.redhat.com/2467822
-
advisory
https://errata.almalinux.org/9/ALSA-2026-22121.html