Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 6

Vulnerabilities 10

• Critical 9.1
  CVE-2026-39834

  Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

  When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses in…

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• High 7.5
  CVE-2026-56851

  Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

  The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

  golang.org/x/text golang.org/x/text/secure/precis renovate trino Debian Ubuntu Azure Linux Wolfi Go
  Oct 7, 2026
• Medium 6.5
  CVE-2026-39827

  Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

  An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connect…

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-27136

  Invoking duplicate attributes can cause XSS in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-42502

  Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 5.9
  CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the files…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of…

  Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• Medium 5.3
  CVE-2026-39835

  Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

  SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 5.3
  CVE-2026-42500

  Panic when reading out of bound palette index in golang.org/x/image/bmp

  Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

  golang.org/x/image golang.org/x/image/bmp seaweedfs golang.org/x/image Debian Ubuntu Wolfi Go
  May 29, 2026
• Medium 5.3
  CVE-2026-46598

  Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

  For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

  golang.org/x/crypto golang.org/x/crypto/ssh/agent zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-42500
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-46598
• report
  https://access.redhat.com/security/cve/CVE-2026-42502
• report
  https://access.redhat.com/security/cve/CVE-2026-39835
• report
  https://access.redhat.com/security/cve/CVE-2026-39834
• report
  https://access.redhat.com/security/cve/CVE-2026-39827
• report
  https://access.redhat.com/security/cve/CVE-2026-27136
• report
  https://access.redhat.com/security/cve/CVE-2026-39817
• report
  https://access.redhat.com/security/cve/CVE-2026-39819
• report
  https://access.redhat.com/security/cve/CVE-2026-56851
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62391.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480757
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27136
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27136
• article
  https://go.dev/cl/781685
• article
  https://go.dev/issue/79575
• article
  https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• advisory
  https://pkg.go.dev/vuln/GO-2026-5030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467825
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39817
• article
  https://go.dev/cl/767520
• article
  https://go.dev/issue/78778
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467813
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39819
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39819
• article
  https://go.dev/cl/763882
• article
  https://go.dev/issue/78584
• advisory
  https://pkg.go.dev/vuln/GO-2026-4978
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480682
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-39827
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-39827
• article
  https://go.dev/cl/781320
• article
  https://go.dev/issue/35127
• article
  https://groups.google.com/g/golang-announce/c/a082jnz-LvI