Skip to content
OpenAdvisories
High · 7.5 CVE-2026-42499 BIT-golang-2026-42499EUVD-2026-28432GHSA-xq5j-9r39-c3vfGO-2026-4977

Quadratic string concatenation in consumePhrase in net/mail

Published May 7, 2026 · Updated Sep 18, 2026 · Assigned by Go

Vendor: Go standard library Product: net/mail Package: aactl Package: act Package: amazon-cloudwatch-agent Package: amazon-k8s-cni Package: argo-cd-3.3-compat Package: argo-events Package: atlantis Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: aws-otel-collector Package: azure-service-operator Package: buildah Package: buildkitd Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cilium-cli Package: cloud-provider-azure-cloud-controller-manager-1.35 Package: cloud-provider-azure-cloud-node-manager-1.35 Package: cni-plugins Package: cni-plugins-aws-k8s-compat Package: cni-plugins-ipam Package: cni-plugins-main Package: cni-plugins-meta Package: conftest Package: consul-k8s-1.9-cli Package: containerd-1 Package: containerd-shim-runc-v2-1 Package: containerd-stress-1 Package: coredns-1.13 Package: cortex Package: crossplane-2.2 Package: crossplane-2.2-crank Package: ctr-1 Package: dask-gateway-server Package: datadog-agent-7.72 Package: datadog-agent-7.72-full Package: datadog-agent-7.73 Package: datadog-agent-7.73-full Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: falco-no-driver Package: fluent-bit-plugin-loki Package: flux-2.7 Package: flyte Package: gatekeeper-3.22 Package: gatekeeper-3.22-gator Package: gatus Package: gitaly-18.11 Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: goreleaser Package: gosh Package: gpu-feature-discovery Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-alloy Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-operator Package: grafana-pyroscope-1.19 Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: helm-3 Package: helm-operator Package: hubble Package: juicefs-1.3 Package: k3d Package: k3s Package: k3s-1.32 Package: k3s-1.35 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-multicall-1.34 Package: k3s-multicall-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.35 Package: k8sgpt Package: k8ssandra-client Package: kaf Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: ko Package: kots Package: kpt Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-csi-external-attacher Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kubevela-vela-cli Package: kubevela-vela-core Package: kuma-cni-2.12 Package: kuma-coredns-1.13 Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kumactl-2.12 Package: kyverno-1.17 Package: kyverno-cli-1.17 Package: libnvidia-container Package: mattermost-11.1 Package: mattermost-11.7 Package: metrics-server Package: minio Package: minio-object-browser Package: nats Package: nerdctl Package: nfpm Package: nuclei Package: nvidia-device-plugin Package: opencost Package: pg_timetable Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: rabbitmq-cluster-operator Package: ratify Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: rclone Package: redka Package: runc Package: scorecard Package: sftpgo Package: skopeo Package: slsa-verifier Package: splunk-otel-collector Package: spqr Package: stdlib Package: tekton-chains Package: teleport-18.6 Package: teleport-18.6-kube-agent-updater Package: teleport-18.6-operator Package: tempo-2.10 Package: tempo-2.10-cli Package: tempo-2.10-vulture Package: tetra Package: tetragon Package: thanos Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: trino Package: tw Package: undock Package: vitess-23 Package: vitess-23-binaries Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected products

VendorProductAffectedFixed
Go standard library net/mail < 1.25.10, 1.26.0-0 – < 1.26.3 1.25.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.3-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +2 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 buildah +1 2:1.43.1-5.el10_2 RHSA-2026:63332
RHEL 10 golang +7 1.26.3-4.el10_2 RHSA-2026:22120
RHEL 10 grafana +1 10.2.6-28.el10_2.5 RHSA-2026:63022
RHEL 10 image-builder 52.1-1.el10_2.2 RHSA-2026:65534
RHEL 10 opentelemetry-collector 0.152.1-2.el10_2 RHSA-2026:65116
RHEL 10 osbuild-composer +2 165.1-3.el10_2.2 RHSA-2026:65895
RHEL 10 podman +3 7:5.8.2-9.el10_2 RHSA-2026:70201
RHEL 10 skopeo +1 2:1.22.2-5.el10_2 RHSA-2026:64818
RHEL 9 golang +7 1.26.3-1.el9_8 RHSA-2026:22121
RHEL 9 grafana +1 10.2.6-23.el9_8.3 RHSA-2026:62406
RHEL 9 image-builder 52.1-1.el9_8.2 RHSA-2026:65886
RHEL 9 opentelemetry-collector 0.152.1-2.el9_8 RHSA-2026:65117
RHEL 9 osbuild-composer +2 165.1-4.el9_8.1 RHSA-2026:65153
RHEL 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 buildah +1 2:1.33.14-6.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 cockpit-podman 84.1-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 conmon 3:2.1.10-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 container-selinux 2:2.229.0-3.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 containernetworking-plugins 1:1.4.0-10.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 containers-common 2:1-82.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 crit +4 3.18-5.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 crun 1.14.3-4.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 delve 1.25.2-1.module+el8.10.0+23746+9db33b5e RHSA-2026:22112
RHEL 8 fuse-overlayfs 1.13-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 golang +7 1.25.10-1.module+el8.10.0+24308+5c4a16b7 RHSA-2026:22112
RHEL 8 grafana +1 9.2.10-33.el8_10 RHSA-2026:62407
RHEL 8 libslirp +1 4.4.0-2.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 netavark 2:1.10.3-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 oci-seccomp-bpf-hook 1.2.10-3.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 osbuild-composer +2 101.5-3.el8_10 RHSA-2026:67148
RHEL 8 podman +6 4:4.9.4-37.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 python-podman +1 4.9.0-3.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 runc 4:1.2.9-6.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 skopeo +1 2:1.14.6-4.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 slirp4netns 1.2.3-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 toolbox +1 0.0.99.5.1-1.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
RHEL 8 udica 0.2.6-21.module+el8.10.0+24790+ef71b018 RHSA-2026:63163
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS golang +7 1.26.5-1.el10_0 RHSA-2026:49702
RHEL 10.0 EUS grafana +1 10.2.6-26.el10_0 RHSA-2026:67517
RHEL 10.0 EUS ignition +2 2.21.0-3.el10_0.4 RHSA-2026:65335
RHEL 10.0 EUS opentelemetry-collector 0.152.1-2.el10_0 RHSA-2026:67974
RHEL 10.0 EUS osbuild-composer +2 134.1-12.el10_0 RHSA-2026:66327
RHEL 9.6 EUS golang +7 1.26.5-1.el9_6 RHSA-2026:49712
RHEL 9.6 EUS grafana +1 10.2.6-22.el9_6 RHSA-2026:51112
RHEL 9.6 EUS ignition +3 2.21.0-7.el9_6.1 RHSA-2026:65336
RHEL 9.6 EUS opentelemetry-collector 0.152.1-2.el9_6 RHSA-2026:67975
RHEL 9.6 EUS osbuild-composer +2 132.2-12.el9_6 RHSA-2026:62803
RHEL 9.4 E4S golang +7 1.26.5-1.el9_4 RHSA-2026:57649
RHEL 9.4 E4S grafana +1 9.2.10-28.el9_4 RHSA-2026:76795
RHEL 9.4 E4S opentelemetry-collector 0.152.1-2.el9_4 RHSA-2026:68527
RHEL 9.4 E4S osbuild-composer +2 101.3-4.el9_4.6 RHSA-2026:62753
RHEL 9.2 E4S golang +7 1.26.5-1.el9_2 RHSA-2026:61253
RHEL 9.2 E4S grafana 9.0.9-13.el9_2 RHSA-2026:76809
RHEL 9.2 E4S osbuild-composer +3 76.1-9.el9_2 RHSA-2026:62754
RHEL 8.8 TUS osbuild-composer +3 75-10.el8_8 RHSA-2026:68504
RHEL 8.8 E4S osbuild-composer +3 75-10.el8_8 RHSA-2026:68504
Red Hat OpenShift 4 butane +1 0.19.0-5.rhaos4.14.el8 RHSA-2026:57482, RHSA-2026:56910, RHSA-2026:56852
Red Hat OpenShift 4 containernetworking-plugins 1:1.4.0-7.rhaos4.12.el8 RHSA-2026:65838, RHSA-2026:59830, RHSA-2026:56910
Red Hat OpenShift 4 cri-o 1.25.5-34.rhaos4.12.git6120b13.el8 RHSA-2026:68534, RHSA-2026:65838, RHSA-2026:60018
Red Hat OpenShift 4 cri-tools 1.25.0-6.el9 RHSA-2026:65838, RHSA-2026:60018, RHSA-2026:59830
Red Hat OpenShift 4 ignition +1 2.18.0-8.rhaos4.16.el9 RHSA-2026:60018, RHSA-2026:57482, RHSA-2026:56852
Red Hat OpenShift 4 microshift +8 4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 RHSA-2026:63636, RHSA-2026:57914, RHSA-2026:57845
Red Hat OpenShift 4 microshift-gateway-api +2 4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9 RHSA-2026:63636, RHSA-2026:57914
Red Hat OpenShift 4 microshift-observability +2 4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9 RHSA-2026:63636
Red Hat OpenShift 4 openshift +1 4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:65838, RHSA-2026:60018
Red Hat OpenShift 4 openshift-clients +1 4.12.0-202608131627.p2.gd691257.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:65838, RHSA-2026:60018
Red Hat OpenShift 4 openshift-kubelet +3 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:60018, RHSA-2026:57482
Red Hat OpenShift 4 ose-aws-ecr-image-credential-provider 4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:60018, RHSA-2026:57482
Red Hat OpenShift 4 ose-azure-acr-image-credential-provider 4.15.0-202608131733.p2.g5638728.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:60018, RHSA-2026:57482
Red Hat OpenShift 4 ose-gcp-gcr-image-credential-provider 4.15.0-202608131733.p2.gfc50272.assembly.stream.el8 RHSA-2026:68534, RHSA-2026:60018, RHSA-2026:57482
Red Hat OpenShift 4 runc 4:1.2.9-5.rhaos4.16.el8 RHSA-2026:56852
Red Hat OpenShift 4 skopeo +1 2:1.9.4-9.rhaos4.12.el8 RHSA-2026:65838, RHSA-2026:59830, RHSA-2026:56852
Red Hat Hardened Images 1 golang1.25 +5 1.25.10-2.2.hum1 RHSA-2026:17713
Red Hat Hardened Images 1 golang1.26 +5 1.26.3-2.2.hum1 RHSA-2026:17714
Red Hat Edge Manager 1 flightctl +2 1.1.4-1.el9em RHSA-2026:68334
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.6.7-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.7.15-2.el9ap RHSA-2026:50336
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.6.7-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 automation-controller +3 4.7.15-2.el9ap RHSA-2026:50336
Red Hat Ansible Automation Platform 2 automation-controller-venv-tower 4.6.31-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 automation-eda-controller +4 1.1.21-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 automation-gateway-proxy +1 2.5.10-7.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 python3.12-aiohttp 3.14.1-2.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 python3.12-daphne 4.2.2-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 python3.12-pillow 12.3.0-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 python3.12-pyasn1 0.6.4-1.el8ap RHSA-2026:50336, RHSA-2026:50319
Red Hat Ansible Automation Platform 2 receptor +1 1.6.7-1.el8ap RHSA-2026:50336, RHSA-2026:50319

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 buildah +1 2:1.43.1-5.el10_2 ALSA-2026:63332
AlmaLinux 10 grafana +1 10.2.6-28.el10_2.5 ALSA-2026:63022
AlmaLinux 10 opentelemetry-collector 0.152.1-2.el10_2 ALSA-2026:65116
AlmaLinux 10 podman +3 7:5.8.2-9.el10_2.alma.1 ALSA-2026:70201
AlmaLinux 10 skopeo +1 2:1.22.2-5.el10_2 ALSA-2026:64818
AlmaLinux 9 golang +7 1.26.3-1.el9_8 ALSA-2026:22121
AlmaLinux 9 grafana +1 10.2.6-23.el9_8.3 ALSA-2026:62406
AlmaLinux 9 opentelemetry-collector 0.152.1-2.el9_8 ALSA-2026:65117
AlmaLinux 9 osbuild-composer +2 165.1-4.el9_8.1.alma.1 ALSA-2026:65153
AlmaLinux 8 aardvark-dns 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 ALSA-2026:63163
AlmaLinux 8 buildah +1 2:1.33.14-6.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 cockpit-podman 84.1-1.module_el8.10.0+4102+6c76e544 ALSA-2026:63163
AlmaLinux 8 conmon 3:2.1.10-1.module_el8.10.0+3845+87b84552 ALSA-2026:63163
AlmaLinux 8 container-selinux 2:2.229.0-3.module_el8.10.0+4213+0493256b ALSA-2026:63163
AlmaLinux 8 containernetworking-plugins 1:1.4.0-10.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 containers-common 2:1-82.module_el8.10.0+4016+efd18bf8 ALSA-2026:63163
AlmaLinux 8 crit +1 3.18-5.module_el8.10.0+3845+87b84552 ALSA-2026:63163
AlmaLinux 8 criu-devel 3.18-5.module_el8.10.0+4016+efd18bf8 ALSA-2026:63163
AlmaLinux 8 criu-libs 3.18-5.module_el8.10.0+3909+6e1c1eb7 ALSA-2026:63163
AlmaLinux 8 crun 1.14.3-4.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 delve 1.25.2-1.module_el8.10.0+4074+24330916 ALSA-2026:22112
AlmaLinux 8 fuse-overlayfs 1.13-1.module_el8.10.0+3909+6e1c1eb7 ALSA-2026:63163
AlmaLinux 8 golang +7 1.25.10-1.module_el8.10.0+4187+c45165c4 ALSA-2026:22112
AlmaLinux 8 grafana +1 9.2.10-33.el8_10 ALSA-2026:62407
AlmaLinux 8 libslirp 4.4.0-2.module_el8.10.0+4016+efd18bf8 ALSA-2026:63163
AlmaLinux 8 libslirp-devel 4.4.0-2.module_el8.10.0+3970+8445edf6 ALSA-2026:63163
AlmaLinux 8 netavark 2:1.10.3-1.module_el8.10.0+3926+f12484f5 ALSA-2026:63163
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.10-3.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 osbuild-composer +2 101.5-3.el8_10.alma.1 ALSA-2026:67148
AlmaLinux 8 podman +6 4:4.9.4-37.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 python3-criu 3.18-5.module_el8.10.0+3858+6ad51f9f ALSA-2026:63163
AlmaLinux 8 python3-podman 4.9.0-3.module_el8.10.0+4016+efd18bf8 ALSA-2026:63163
AlmaLinux 8 runc 4:1.2.9-6.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 skopeo +1 2:1.14.6-4.module_el8.10.0+4269+94686149 ALSA-2026:63163
AlmaLinux 8 slirp4netns 1.2.3-1.module_el8.10.0+3901+4b80ecd7 ALSA-2026:63163
AlmaLinux 8 toolbox +1 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47 ALSA-2026:63163
AlmaLinux 8 udica 0.2.6-21.module_el8.10.0+4068+0e21408f ALSA-2026:63163

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 buildah 2:1.43.1-5.el10_2 RLSA-2026:63332
Rocky Linux 10 golang 1.26.3-4.el10_2 RLSA-2026:22120
Rocky Linux 10 grafana 10.2.6-28.el10_2.5 RLSA-2026:63022
Rocky Linux 10 image-builder 52.1-1.el10_2.2.rocky.0.1 RLSA-2026:65534
Rocky Linux 10 opentelemetry-collector 0.152.1-2.el10_2 RLSA-2026:65116
Rocky Linux 10 osbuild-composer 165.1-3.el10_2.2.rocky.0.1 RLSA-2026:65895
Rocky Linux 10 podman 7:5.8.2-9.el10_2 RLSA-2026:70201
Rocky Linux 10 skopeo 2:1.22.2-5.el10_2 RLSA-2026:64818
Rocky Linux 9 golang 1.26.3-1.el9_8 RLSA-2026:22121
Rocky Linux 9 grafana 10.2.6-23.el9_8.3 RLSA-2026:62406
Rocky Linux 9 image-builder 52.1-1.el9_8.2 RLSA-2026:65886
Rocky Linux 9 opentelemetry-collector 0.152.1-2.el9_8 RLSA-2026:65117
Rocky Linux 9 osbuild-composer 165.1-4.el9_8.1.rocky.0.1 RLSA-2026:65153
Rocky Linux 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1874+ce489889 RLSA-2026:63163
Rocky Linux 8 cockpit-podman 84.1-1.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 conmon 3:2.1.10-1.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 container-selinux 2:2.229.0-3.module+el8.10.0+40223+e940a224 RLSA-2026:63163
Rocky Linux 8 containers-common 2:1-82.module+el8.10.0+1843+6892ab28 RLSA-2026:63163
Rocky Linux 8 criu 3.18-5.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 delve 1.25.2-1.module+el8.10.0+40035+ee0a7047 RLSA-2026:22112
Rocky Linux 8 fuse-overlayfs 1.13-1.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 golang 1.25.10-1.module+el8.10.0+40200+0fd0f175 RLSA-2026:22112
Rocky Linux 8 grafana 9.2.10-33.el8_10 RLSA-2026:62407
Rocky Linux 8 libslirp 4.4.0-2.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 netavark 2:1.10.3-1.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 osbuild-composer 101.5-3.el8_10.rocky.0.6 RLSA-2026:67148
Rocky Linux 8 python-podman 4.9.0-3.module+el8.10.0+1896+b18fa106 RLSA-2026:63163
Rocky Linux 8 slirp4netns 1.2.3-1.module+el8.10.0+1815+5fe7415e RLSA-2026:63163
Rocky Linux 8 toolbox 0.0.99.5.1-1.module+el8.10.0+40087+cfe9c127.rocky.0.2 RLSA-2026:63163
Rocky Linux 8 udica 0.2.6-21.module+el8.10.0+1815+5fe7415e RLSA-2026:63163

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES for SAP 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1
SLES 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.25 1.25.10-1.1 openSUSE-SU-2026:10723-1
openSUSE Tumbleweed go1.26 1.26.3-1.1 openSUSE-SU-2026:10741-1
openSUSE Leap 16.0 go1.25-openssl 1.25.12-160000.1.1 openSUSE-SU-2026:21319-1
openSUSE Leap 16.0 go1.26-openssl 1.26.4-160000.1.1 openSUSE-SU-2026:21254-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.3-r0 —
Alpine v3.24 rclone 1.74.1-r0 —
Alpine v3.23 go 1.25.10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300066.2-2.amzn2023 ALAS2023-2026-1747
Amazon Linux 2023 amazon-ecr-credential-helper 0.12.0-3.amzn2023 ALAS2023-2026-1738
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.6 ALAS2023-2026-1723
Amazon Linux 2023 containerd +1 2.2.3-1.amzn2023.0.2 ALAS2023-2026-1737
Amazon Linux 2023 credentials-fetcher 2.0.1-1.amzn2023.0.5 ALAS2023-2026-1744
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.6 ALAS2023-2026-1736
Amazon Linux 2023 ecs-init 1.103.2-1.amzn2023 ALAS2023-2026-1771
Amazon Linux 2023 git-lfs 3.7.1-80.amzn2023 ALAS2023-2026-1722
Amazon Linux 2023 golang +6 1.25.10-1.amzn2023.0.1 ALAS2023-2026-1743
Amazon Linux 2023 golang-github-burntsushi-toml +1 1.5.0-1.amzn2023.0.1 ALAS2023-2026-1751
Amazon Linux 2023 golang-github-burntsushi-toml-test +1 0.2.0-8.amzn2023.0.3 ALAS2023-2026-1750
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-24.amzn2023.0.7 ALAS2023-2026-1749
Amazon Linux 2023 golist 0.10.4-12.amzn2023.0.9 ALAS2023-2026-1742
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.7 ALAS2023-2026-1721
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.2 ALAS2023-2026-1735
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.11 ALAS2023-2026-1739
Amazon Linux 2023 rclone 1.73.5-76.amzn2023 ALAS2023-2026-1717
Amazon Linux 2023 runc 1.3.4-5.amzn2023.0.2 ALAS2023-2026-1715
Amazon Linux 2023 runfinch-finch 1.17.0-1.amzn2023.0.2 ALAS2023-2026-1741
Amazon Linux 2023 soci-snapshotter 0.13.0-1.amzn2023.0.3 ALAS2023-2026-1740
Amazon Linux 2023 yq 4.47.1-13.amzn2023 ALAS2023-2026-1716
Amazon Linux 2 amazon-cloudwatch-agent 1.300066.2-2.amzn2 ALAS2-2026-3323
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.6 ALAS2-2026-3311
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.6 ALAS2-2026-3310
Amazon Linux 2 golang +6 1.25.10-1.amzn2.0.1 ALAS2-2026-3313
Amazon Linux 2 golist 0.10.1-10.amzn2.0.13 ALAS2-2026-3308
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.2 ALAS2-2026-3319
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.6 ALAS2-2026-3309

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 golang +7 1.26.5-1.0.1.el10_2 ELSA-2026-22120
Oracle Linux 10 podman +3 7:5.8.2-9.0.1.el10_2 ELSA-2026-70201
Oracle Linux 9 golang +7 1.26.3-1.0.1.el9_8 ELSA-2026-22121
Oracle Linux 8 delve 1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd ELSA-2026-22112
Oracle Linux 8 golang +7 1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb ELSA-2026-22112

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r50 —
Wolfi rolling act 0.2.88-r2 —
Wolfi rolling amazon-cloudwatch-agent 1.300067.0-r2 —
Wolfi rolling amazon-k8s-cni 1.21.1-r6 —
Wolfi rolling argo-cd-3.3-compat 3.3.9-r2 —
Wolfi rolling argo-events 1.9.10-r18 —
Wolfi rolling atlantis 0.43.0-r0 —
Wolfi rolling aws-flb-cloudwatch 1.9.5-r1 —
Wolfi rolling aws-flb-firehose 1.7.3-r1 —
Wolfi rolling aws-flb-kinesis 1.10.4-r1 —
Wolfi rolling aws-otel-collector 0.47.0-r12 —
Wolfi rolling azure-service-operator 2.19.0-r0 —
Wolfi rolling buildah 1.43.1-r2 —
Wolfi rolling buildkitd 0.29.0-r8 —
Wolfi rolling cert-manager-1.20 +5 1.20.2-r3 —
Wolfi rolling cilium-cli 0.19.2-r11 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.35 +1 1.35.3-r5 —
Wolfi rolling cni-plugins +3 1.9.1-r4 —
Wolfi rolling cni-plugins-main 1.9.1-r3 —
Wolfi rolling conftest 0.68.2-r3 —
Wolfi rolling consul-k8s-1.9-cli 1.9.7-r2 —
Wolfi rolling coredns-1.13 +1 1.13.2-r5 —
Wolfi rolling cortex 1.21.0-r2 —
Wolfi rolling crossplane-2.2 +1 2.2.1-r0 —
Wolfi rolling ctr-1 +3 1.7.31-r2 —
Wolfi rolling dask-gateway-server 2026.3.0-r4 —
Wolfi rolling datadog-agent-7.72 +1 7.72.4-r22 —
Wolfi rolling datadog-agent-7.73-full +1 7.73.3-r13 —
Wolfi rolling dockerd-29 29.4.3-r0 —
Wolfi rolling dogstatsd-7.72 +1 7.72.4-r21 —
Wolfi rolling dogstatsd-7.73 +1 7.73.3-r12 —
Wolfi rolling falco-no-driver 0.44.0-r0 —
Wolfi rolling fluent-bit-plugin-loki 3.7.1-r5 —
Wolfi rolling flux-2.7 2.7.5-r16 —
Wolfi rolling flyte 1.16.6-r0 —
Wolfi rolling gatekeeper-3.22 +1 3.22.2-r1 —
Wolfi rolling gatus 5.35.0-r12 —
Wolfi rolling gitaly-18.11 18.11.2-r1 —
Wolfi rolling go-1.24 1.24.13-r0 —
Wolfi rolling go-1.24-nm +5 No fix yet —
Wolfi rolling go-1.26 1.26.3-r0 —
Wolfi rolling goreleaser 2.15.4-r1 —
Wolfi rolling gosh 0.0.47-r0 —
Wolfi rolling gpu-feature-discovery 0.19.1-r1 —
Wolfi rolling grafana-12.3 12.3.6.01-r5 —
Wolfi rolling grafana-12.4 12.4.2-r11 —
Wolfi rolling grafana-13.0 13.0.1-r3 —
Wolfi rolling grafana-alloy 1.15.1-r5 —
Wolfi rolling grafana-mimir-3.0 +1 3.0.6-r2 —
Wolfi rolling grafana-operator 5.22.2-r5 —
Wolfi rolling grafana-pyroscope-1.19 1.19.3-r3 —
Wolfi rolling harbor-2.14 +1 2.14.3-r16 —
Wolfi rolling harbor-2.14-exporter +1 2.14.3-r15 —
Wolfi rolling helm-3 3.20.2-r0 —
Wolfi rolling helm-operator 1.42.2-r5 —
Wolfi rolling hubble 1.19.3-r2 —
Wolfi rolling juicefs-1.3 1.3.1-r14 —
Wolfi rolling k3d 5.8.3-r33 —
Wolfi rolling k3s +1 1.35.3.1-r7 —
Wolfi rolling k3s-1.32 +1 1.32.13.1-r16 —
Wolfi rolling k3s-1.35 +2 1.35.3.1-r5 —
Wolfi rolling k3s-multicall-1.34 1.34.6.1-r6 —
Wolfi rolling k3s-static 1.35.3.1-r8 —
Wolfi rolling k3s-static-1.32 1.32.13.1-r15 —
Wolfi rolling k8sgpt 0.4.33-r0 —
Wolfi rolling k8ssandra-client 0.8.11-r1 —
Wolfi rolling kaf 0.2.14-r3 —
Wolfi rolling keda-2.19 +1 2.19.0-r13 —
Wolfi rolling ko 0.18.1-r14 —
Wolfi rolling kots 1.130.2-r1 —
Wolfi rolling kpt 1.0.0_beta55-r20 —
Wolfi rolling kube-fluentd-operator 1.18.2-r63 —
Wolfi rolling kube-proxy-1.35 +1 1.35.4-r4 —
Wolfi rolling kube-proxy-1.36 +1 1.36.0-r0 —
Wolfi rolling kubeadm-1.34 +3 1.34.7-r1 —
Wolfi rolling kubeadm-1.35 +5 1.35.4-r3 —
Wolfi rolling kubeadm-1.36 +5 1.36.0-r1 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubectl-1.33 1.33.11-r1 —
Wolfi rolling kubectl-1.34 +3 1.34.7-r2 —
Wolfi rolling kubectl-bash-completion-1.35 +3 1.35.8-r6 —
Wolfi rolling kubernetes-csi-external-attacher 4.11.0-r9 —
Wolfi rolling kubernetes-dashboard 7.14.0-r6 —
Wolfi rolling kubevela-vela-cli +1 1.10.8-r5 —
Wolfi rolling kuma-cp-2.12 +3 2.12.3-r14 —
Wolfi rolling kyverno-1.17 +1 1.17.2-r35 —
Wolfi rolling libnvidia-container 1.19.0-r1 —
Wolfi rolling mattermost-11.1 11.1.3-r2 —
Wolfi rolling mattermost-11.7 11.7.0-r1 —
Wolfi rolling metrics-server 0.8.1-r6 —
Wolfi rolling minio 0.20260504.002721-r1 —
Wolfi rolling minio-object-browser 2.0.4-r12 —
Wolfi rolling nats 0.3.2-r4 —
Wolfi rolling nerdctl 2.2.2-r5 —
Wolfi rolling nfpm 2.46.3-r0 —
Wolfi rolling nuclei 3.8.0-r3 —
Wolfi rolling nvidia-device-plugin 0.19.1-r0 —
Wolfi rolling opencost 1.120.1-r1 —
Wolfi rolling pg_timetable 6.3.0-r3 —
Wolfi rolling prometheus-3.10 3.10.0-r6 —
Wolfi rolling prometheus-3.11 3.11.3-r0 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-3.9 3.9.1-r4 —
Wolfi rolling prometheus-adapter 0.12.0-r25 —
Wolfi rolling prometheus-config-reloader 0.91.0-r0 —
Wolfi rolling prometheus-operator +1 0.91.0-r1 —
Wolfi rolling rabbitmq-cluster-operator 2.20.1-r0 —
Wolfi rolling ratify 1.4.0-r27 —
Wolfi rolling ratify-schemavalidator +1 1.4.0-r28 —
Wolfi rolling redka 1.0.1-r1 —
Wolfi rolling runc 1.4.2-r2 —
Wolfi rolling scorecard 5.5.0-r1 —
Wolfi rolling sftpgo 2.7.1-r9 —
Wolfi rolling skopeo 1.22.2-r1 —
Wolfi rolling slsa-verifier 2.7.1-r16 —
Wolfi rolling splunk-otel-collector 0.150.0-r0 —
Wolfi rolling spqr 2.9.0-r7 —
Wolfi rolling tekton-chains 0.26.3-r1 —
Wolfi rolling teleport-18.6 +2 18.6.8-r13 —
Wolfi rolling tempo-2.10 2.10.5-r1 —
Wolfi rolling tempo-2.10-cli +1 2.10.5-r2 —
Wolfi rolling tetra +1 1.6.0-r8 —
Wolfi rolling thanos 0.41.0-r11 —
Wolfi rolling timestamp-authority-cli 2.0.6-r1 —
Wolfi rolling timestamp-authority-server 2.0.6-r0 —
Wolfi rolling tkn 0.44.1-r5 —
Wolfi rolling trino 480-r15 —
Wolfi rolling tw 0.0.47-r1 —
Wolfi rolling undock 0.13.0-r1 —
Wolfi rolling vitess-23 23.0.4-r0 —
Wolfi rolling vitess-23-binaries 23.0.4-r1 —
Wolfi rolling zarf 0.75.1-r0 —
Wolfi rolling zot 2.1.16-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.25.10 · >= 1.26.0-0, < 1.26.3 1.25.10, 1.26.3 GO-2026-4977

Advisories 50

References