Red Hat Security Advisory: golang security update

Fixed packages 8

Vulnerabilities 11

• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-33814

  Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

  When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39836

  Panic in Dial and LookupPort when handling NUL byte on Windows in net

  The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42501

  Malicious module proxy can bypass checksum database in cmd/go

  A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-39823

  Bypass of meta content URL escaping causes XSS in html/template

  CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to si…

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.1
  CVE-2026-39826

  Escaper bypass leads to XSS in html/template

  If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.9
  CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39825

  ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

  ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are…

  Go standard library net/http/httputil golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467809
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467811
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467826
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467827
• article
  https://issues.redhat.com/browse/RHEL-175605
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22120.json
• report
  https://access.redhat.com/security/cve/CVE-2026-33811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33811
• article
  https://go.dev/cl/767860
• article
  https://go.dev/issue/78803
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4981
• report
  https://access.redhat.com/security/cve/CVE-2026-33814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33814
• article
  https://go.dev/cl/761581
• article
  https://go.dev/cl/761640
• article
  https://go.dev/issue/78476
• advisory
  https://pkg.go.dev/vuln/GO-2026-4918
• report
  https://access.redhat.com/security/cve/CVE-2026-39817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39817
• article
  https://go.dev/cl/767520
• article
  https://go.dev/issue/78778
• advisory
  https://pkg.go.dev/vuln/GO-2026-4979
• report
  https://access.redhat.com/security/cve/CVE-2026-39819
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39819
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39819
• article
  https://go.dev/cl/763882
• article
  https://go.dev/issue/78584