Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 5

• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-27137

  Incorrect enforcement of email constraints in crypto/x509

  When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• Medium 6.1
  CVE-2026-27142

  URLs in meta content attribute actions are not escaped in html/template

  Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be …

  Go standard library html/template langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• Medium 5.9
  CVE-2026-27138

  Panic in name constraint checking for malformed certificates in crypto/x509

  Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• Low 2.5
  CVE-2026-27139

  FileInfo can escape from a Root in os

  On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by …

  Go standard library os langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026

Revision history

1. 2026-11-12 #98

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-10 #97

   Neue Updates von Red Hat aufgenommen

3. 2026-11-05 #96

   Neue Updates von Red Hat aufgenommen

4. 2026-11-01 #95

   Neue Updates von Red Hat aufgenommen

5. 2026-10-27 #94

   Neue Updates von Red Hat aufgenommen

6. 2026-10-26 #93

   Neue Updates von Red Hat aufgenommen

7. 2026-10-22 #92

   Neue Updates von Red Hat aufgenommen

8. 2026-10-21 #91

   Neue Updates von Red Hat aufgenommen

9. 2026-10-06 #90

   Neue Updates von Red Hat aufgenommen

10. 2026-09-16 #89

    Neue Updates von Red Hat aufgenommen

11. 2026-09-13 #88

    Neue Updates von Red Hat aufgenommen

12. 2026-09-10 #87

    Neue Updates von Red Hat aufgenommen

13. 2026-09-03 #86

    Neue Updates von Red Hat und Oracle Linux aufgenommen

14. 2026-08-30 #85

    Neue Updates von Red Hat aufgenommen

15. 2026-08-26 #84

    Neue Updates von Red Hat aufgenommen

16. 2026-08-25 #83

    Neue Updates von Red Hat aufgenommen

17. 2026-08-13 #82

    Neue Updates von Red Hat aufgenommen

18. 2026-08-09 #81

    Neue Updates von Red Hat aufgenommen

19. 2026-08-06 #80

    Neue Updates von Red Hat aufgenommen

20. 2026-08-05 #79

    Neue Updates von Oracle Linux aufgenommen

21. 2026-08-03 #78

    Neue Updates von Red Hat aufgenommen

22. 2026-07-29 #77

    Neue Updates von Red Hat aufgenommen

23. 2026-07-27 #76

    Neue Updates von Oracle Linux aufgenommen

24. 2026-07-26 #75

    Neue Updates von Oracle Linux aufgenommen

25. 2026-07-21 #74

    Neue Updates von SUSE aufgenommen

References

• Go 1.26.1 and Go 1.25.8 pre-announcement vom 2026-02-26
  https://groups.google.com/g/golang-announce/c/qbkuaO2xasI/m/hmaB1OGBBQAJ?pli=1
• openSUSE Security Update OPENSUSE-SU-2026:10310-1 vom 2026-03-09
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/B2IXB7BTZPU5M6YJC45KXVXGXWNVXGGJ/
• SUSE Security Update SUSE-SU-2026:0875-1 vom 2026-03-12
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024674.html
• SUSE Security Update SUSE-SU-2026:0876-1 vom 2026-03-12
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024673.html
• Amazon Linux Security Advisory ALAS2-2026-3203 vom 2026-03-19
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3203.html
• Amazon Linux Security Advisory ALAS2-2026-3202 vom 2026-03-19
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3202.html
• SUSE Security Update SUSE-SU-2026:0947-1 vom 2026-03-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024783.html
• Red Hat Security Advisory RHSA-2026:5192 vom 2026-03-20
  https://access.redhat.com/errata/RHSA-2026:5192
• Red Hat Security Advisory RHSA-2026:5549 vom 2026-03-24
  https://access.redhat.com/errata/RHSA-2026:5549
• SUSE Security Update SUSE-SU-2026:0976-1 vom 2026-03-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024821.html
• SUSE Security Update SUSE-SU-2026:0977-1 vom 2026-03-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024820.html
• SUSE Security Update SUSE-SU-2026:0993-1 vom 2026-03-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024870.html
• Oracle Linux Security Advisory ELSA-2026-5942 vom 2026-03-27
  http://linux.oracle.com/errata/ELSA-2026-5942.html
• Oracle Linux Security Advisory ELSA-2026-5941 vom 2026-03-26
  https://linux.oracle.com/errata/ELSA-2026-5941.html
• Oracle Linux Security Advisory ELSA-2026-5942 vom 2026-03-27
  https://linux.oracle.com/errata/ELSA-2026-5942.html
• Red Hat Security Advisory RHSA-2026:5941 vom 2026-03-26
  https://access.redhat.com/errata/RHSA-2026:5941
• Red Hat Security Advisory RHSA-2026:5942 vom 2026-03-26
  https://access.redhat.com/errata/RHSA-2026:5942
• Red Hat Security Advisory RHSA-2026:5944 vom 2026-03-26
  https://access.redhat.com/errata/RHSA-2026:5944
• Red Hat Security Advisory RHSA-2026:6341 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6341
• Red Hat Security Advisory RHSA-2026:6344 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6344
• Oracle Linux Security Advisory ELSA-2026-6344 vom 2026-04-01
  https://linux.oracle.com/errata/ELSA-2026-6344.html
• Red Hat Security Advisory RHSA-2026:6388 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6388
• Red Hat Security Advisory RHSA-2026:6383 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6383
• Oracle Linux Security Advisory ELSA-2026-6388 vom 2026-04-01
  https://linux.oracle.com/errata/ELSA-2026-6388.html
• Red Hat Security Advisory RHSA-2026:6382 vom 2026-04-01
  https://access.redhat.com/errata/RHSA-2026:6382
• Oracle Linux Security Advisory ELSA-2026-6382 vom 2026-04-02
  https://linux.oracle.com/errata/ELSA-2026-6382.html
• Oracle Linux Security Advisory ELSA-2026-6383 vom 2026-04-02
  https://linux.oracle.com/errata/ELSA-2026-6383.html
• Rocky Linux Security Advisory RLSA-2026:6949 vom 2026-04-08
  https://errata.build.resf.org/RLSA-2026:6949
• Red Hat Security Advisory RHSA-2026:6949 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:6949
• Rocky Linux Security Advisory RLSA-2026:5942 vom 2026-04-07
  https://errata.build.resf.org/RLSA-2026:5942
• Red Hat Security Advisory RHSA-2026:7005 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:7005
• Red Hat Security Advisory RHSA-2026:7009 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7009
• Red Hat Security Advisory RHSA-2026:7011 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7011
• Red Hat Security Advisory RHSA-2026:7259 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7259
• Red Hat Security Advisory RHSA-2026:7328 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7328
• Oracle Linux Security Advisory ELSA-2026-6949 vom 2026-04-09
  https://linux.oracle.com/errata/ELSA-2026-6949.html
• Rocky Linux Security Advisory RLSA-2026:5941 vom 2026-04-09
  https://errata.build.resf.org/RLSA-2026:5941
• Red Hat Security Advisory RHSA-2026:7315 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7315
• Red Hat Security Advisory RHSA-2026:6564 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:6564
• Red Hat Security Advisory RHSA-2026:7665 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7665
• Red Hat Security Advisory RHSA-2026:7674 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7674
• Red Hat Security Advisory RHSA-2026:7669 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7669
• Red Hat Security Advisory RHSA-2026:7833 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7833
• Amazon Linux Security Advisory ALAS2DOCKER-2026-108 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-108.html
• Red Hat Security Advisory RHSA-2026:7876 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7876
• Red Hat Security Advisory RHSA-2026:7877 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7877
• Red Hat Security Advisory RHSA-2026:7878 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7878
• Red Hat Security Advisory RHSA-2026:7883 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7883
• Red Hat Security Advisory RHSA-2026:7879 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7879
• Red Hat Security Advisory RHSA-2026:7834 vom 2026-04-13
  https://access.redhat.com/errata/RHSA-2026:7834
• Amazon Linux Security Advisory ALAS2-2026-3229 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3229.html
• Amazon Linux Security Advisory ALAS2ECS-2026-103 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-103.html
• Amazon Linux Security Advisory ALAS2ECS-2026-102 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-102.html
• Amazon Linux Security Advisory ALAS2ECS-2026-101 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-101.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-096 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-096.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-110 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-110.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-095 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-095.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-109 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-109.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-094 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-094.html
• Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-093 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-093.html
• Red Hat Security Advisory RHSA-2026:7992 vom 2026-04-14
  https://access.redhat.com/errata/RHSA-2026:7992
• Amazon Linux Security Advisory ALAS2-2026-3248 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3248.html
• Amazon Linux Security Advisory ALAS2ECS-2026-106 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-106.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-107 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-107.html
• Amazon Linux Security Advisory ALAS2ECS-2026-105 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-105.html
• Amazon Linux Security Advisory ALAS2ECS-2026-104 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-104.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-105 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-105.html
• Amazon Linux Security Advisory ALAS2DOCKER-2026-104 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-104.html
• Oracle Linux Security Advisory ELSA-2026-7992 vom 2026-04-14
  https://linux.oracle.com/errata/ELSA-2026-7992.html
• Red Hat Security Advisory RHSA-2026:8167 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8167
• Red Hat Security Advisory RHSA-2026:8337 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8337
• Rocky Linux Security Advisory RLSA-2026:7992 vom 2026-04-15
  https://errata.build.resf.org/RLSA-2026:7992
• Red Hat Security Advisory RHSA-2026:8338 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8338
• Red Hat Security Advisory RHSA-2026:8314 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8314
• Red Hat Security Advisory RHSA-2026:8322 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8322
• Red Hat Security Advisory RHSA-2026:8324 vom 2026-04-15
  https://access.redhat.com/errata/RHSA-2026:8324
• Red Hat Security Advisory RHSA-2026:8434 vom 2026-04-16
  https://access.redhat.com/errata/RHSA-2026:8434
• Oracle Linux Security Advisory ELSA-2026-7259 vom 2026-04-14
  http://linux.oracle.com/errata/ELSA-2026-7259.html
• Oracle Linux Security Advisory ELSA-2026-7009 vom 2026-04-14
  http://linux.oracle.com/errata/ELSA-2026-7009.html
• Oracle Linux Security Advisory ELSA-2026-7005 vom 2026-04-14
  http://linux.oracle.com/errata/ELSA-2026-7005.html