Skip to content
OpenAdvisories
High RHSA-2026:28038 4 CVEs

Red Hat Security Advisory: gvisor-tap-vsock security update

Published Jun 23, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream gvisor-tap-vsock 6:0.8.5-2.el9_6.2
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream gvisor-tap-vsock-debuginfo 6:0.8.5-2.el9_6.2
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream gvisor-tap-vsock-debugsource 6:0.8.5-2.el9_6.2
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream gvisor-tap-vsock-gvforwarder 6:0.8.5-2.el9_6.2
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream gvisor-tap-vsock-gvforwarder-debuginfo 6:0.8.5-2.el9_6.2

Vulnerabilities 4

  • High 7.5
    CVE-2026-27137

    Incorrect enforcement of email constraints in crypto/x509

    When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32280

    Unexpected work during chain building in crypto/x509

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.4
    CVE-2026-32282

    TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

    On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

    Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2445345
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456336
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456339
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28038.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-27137
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-27137
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-27137
  • article
    https://go.dev/cl/752182
  • article
    https://go.dev/issue/77952
  • article
    https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4599
  • report
    https://access.redhat.com/security/cve/CVE-2026-32280
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32280
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32280
  • article
    https://go.dev/cl/758320
  • article
    https://go.dev/issue/78282
  • article
    https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4947
  • report
    https://access.redhat.com/security/cve/CVE-2026-32282
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32282
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32282
  • article
    https://go.dev/cl/763761
  • article
    https://go.dev/issue/78293
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4864
  • report
    https://access.redhat.com/security/cve/CVE-2026-32283
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32283
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32283
  • article
    https://go.dev/cl/763767
  • article
    https://go.dev/issue/78334
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4870