Red Hat Security Advisory: go-toolset:rhel8 security update

Fixed packages 11

Vulnerabilities 13

• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39836

  Panic in Dial and LookupPort when handling NUL byte on Windows in net

  The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42501

  Malicious module proxy can bypass checksum database in cmd/go

  A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-32289

  JsBraceDepth Context Tracking Bugs (XSS) in html/template

  Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, le…

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 6.1
  CVE-2026-39823

  Bypass of meta content URL escaping causes XSS in html/template

  CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-39826

  Escaper bypass leads to XSS in html/template

  If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.9
  CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.5
  CVE-2026-32288

  Unbounded allocation for old GNU sparse in archive/tar

  tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

  Go standard library archive/tar golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 5.3
  CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39825

  ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

  ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are…

  Go standard library net/http/httputil golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467809
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467811
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467826
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467827
• article
  https://issues.redhat.com/browse/RHEL-175610
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22112.json
• report
  https://access.redhat.com/security/cve/CVE-2026-32288
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456332
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32288
• article
  https://go.dev/cl/763766
• article
  https://go.dev/issue/78301
• article
  https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• advisory
  https://pkg.go.dev/vuln/GO-2026-4869
• report
  https://access.redhat.com/security/cve/CVE-2026-32289
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456334
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32289
• article
  https://go.dev/cl/763762
• article
  https://go.dev/issue/78331
• advisory
  https://pkg.go.dev/vuln/GO-2026-4865
• report
  https://access.redhat.com/security/cve/CVE-2026-33811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33811
• article
  https://go.dev/cl/767860
• article
  https://go.dev/issue/78803
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4981
• report
  https://access.redhat.com/security/cve/CVE-2026-33814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33814