High ELSA-2026-36317 2 CVEs

Important: skopeo security update (Oracle Linux 9)

Published Jul 7, 2026 · Updated Jul 7, 2026

Ecosystem: Oracle Linux

Summary

[1:1.22.2-7]
- Rebuild for golang >= 1.26.4 to fix CVE-2026-27145
- Resolves: RHEL-189898

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	skopeo	2:1.22.2-7.el9_8
Oracle Linux · 9	skopeo-tests	2:1.22.2-7.el9_8

Vulnerabilities 2

High 7.5

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 6, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026