High ELSA-2026-39573 3 CVEs

Important: yggdrasil security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[0.4.9.2-1]
- Update yggdrasil to 0.4.9.2

[0.4.9.1-1]
- Update yggdrasil to 0.4.9.1

[0.4.9-5]
- Bump release for rebuild

[0.4.9-4]
- Bump release for rebuild

[0.4.9-3]
- Bump release for rebuild

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 10	yggdrasil	0:0.4.9.2-1.el10_2
Oracle Linux · 10	yggdrasil-devel	0:0.4.9.2-1.el10_2

Vulnerabilities 3

Critical 9.6

CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

May 22, 2026
High 7.5

CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026
Medium 6.5

CVE-2026-27145 Public exploit

Inefficient candidate hostname parsing in crypto/x509

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go

Jun 2, 2026