Red Hat Security Advisory: delve security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 4

• High 7.5
  CVE-2026-27137

  Incorrect enforcement of email constraints in crypto/x509

  When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-33810

  Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

  When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484207
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49703.json
• report
  https://access.redhat.com/security/cve/CVE-2026-27137
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445345
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27137
• article
  https://go.dev/cl/752182
• article
  https://go.dev/issue/77952
• article
  https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4599
• report
  https://access.redhat.com/security/cve/CVE-2026-27145
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27145
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27145
• article
  https://go.dev/cl/783621
• article
  https://go.dev/issue/79694
• article
  https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• advisory
  https://pkg.go.dev/vuln/GO-2026-5037
• report
  https://access.redhat.com/security/cve/CVE-2026-33810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456335
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33810
• article
  https://go.dev/cl/763763
• article
  https://go.dev/issue/78332
• article
  https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• advisory
  https://pkg.go.dev/vuln/GO-2026-4866
• report
  https://access.redhat.com/security/cve/CVE-2026-33811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33811
• article
  https://go.dev/cl/767860
• article
  https://go.dev/issue/78803
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4981