High ELSA-2026-35832 2 CVEs

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[0.9.27-7.2]
- rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145

[0.9.27-7.1]
- rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281

[0.9.27-7]
- rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283,
CVE-2026-33810

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 10	ipp-usb	0:0.9.27-7.el10_2.2

Vulnerabilities 2

High 7.5

CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026