High ELSA-2026-38995 3 CVEs

Important: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

Published Jul 14, 2026 · Updated Jul 14, 2026

Ecosystem: Oracle Linux

Summary

delve
[1.26.1-1.0.1]
- Disable DWARF compression which has issues (Alex Burmashev)

[1.26.1-1]
- Update to Delve 1.26.1
- Related: RHEL-183712

golang
[1.26.5-1.0.1]
- EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var
- Backported from OL9u7
- Resolves: OLDIS-53586

[1.26.5-1]
- Update to Go 1.26.5 (fips-1)
- Resolves: RHEL-193478

[1.26.4-1]
- Update to Go 1.26.4 (fips-1)
- Resolves: RHEL-183352

[1.25.10-1]
- Update to Go 1.25.10 (fips-1)
- Resolves: RHEL-175610

Fixed packages 9

Release	Package	Fixed in
Oracle Linux · 8	delve	0:1.26.1-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	go-toolset	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-bin	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-docs	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-misc	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-race	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-src	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3
Oracle Linux · 8	golang-tests	0:1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3

Vulnerabilities 3

Critical 9.6

CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

May 22, 2026
High 7.8

CVE-2026-39822

Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even whe…

Go standard library os katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jul 8, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026