RHSA-2026:10704HighCVSS 9.0

Red Hat Security Advisory: go-toolset:rhel8 security update

Published
April 27, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (6)

CVE-2026-27140 →CVE-2026-27143 →CVE-2026-27144 →CVE-2026-32280 →CVE-2026-32282 →CVE-2026-32283 →

📋 Description

CVE-2026-27140 — cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names CVE-2026-27143 — golang: cmd/compile: possible memory corruption after bound check elimination CVE-2026-27144 — golang: cmd/compile: no-op interface conversion bypasses overlap checking CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 8)
  • delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur. Workaround: To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as 'any' or 'interface{}') just before a move operation, refactor the code to use concrete types or explicit pointers instead. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)