Summary
The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.4+1 [almalinux-9.8.z] (JIRA:AlmaLinux-183350)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | go-toolset | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-bin | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-docs | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-misc | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-race | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-src | 1.26.4-1.el9_8 |
| AlmaLinux · 9 | golang-tests | 1.26.4-1.el9_8 |
Vulnerabilities 3
-
High 7.5
Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
-
Medium 6.5CVE-2026-27145 Public exploit
Inefficient candidate hostname parsing in crypto/x509
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…
-
Medium 5.3
Arbitrary inputs are included in errors without any escaping in net/textproto
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
References
-
report
https://access.redhat.com/security/cve/CVE-2026-42507
-
report
https://bugzilla.redhat.com/2484205
-
advisory
https://errata.almalinux.org/9/ALSA-2026-29981.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-27145.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-42504.html