RHSA-2026:16024HighCVSS 9.0

Red Hat Security Advisory: golang security update

Published
May 11, 2026
Last Modified
August 12, 2026

🔗 CVE IDs covered (7)

CVE-2026-32283 →CVE-2026-27140 →CVE-2026-27143 →CVE-2026-27144 →CVE-2026-32280 →CVE-2026-32281 →CVE-2026-32282 →

📋 Description

CVE-2026-27140 — cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names CVE-2026-27143 — golang: cmd/compile: possible memory corruption after bound check elimination CVE-2026-27144 — golang: cmd/compile: no-op interface conversion bypasses overlap checking CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

🎯 Affected products22

  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • go-toolset-0:1.25.9-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • go-toolset-0:1.25.9-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • go-toolset-0:1.25.9-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • go-toolset-0:1.25.9-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-0:1.25.9-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-0:1.25.9-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-0:1.25.9-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-0:1.25.9-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-0:1.25.9-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-bin-0:1.25.9-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-bin-0:1.25.9-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-bin-0:1.25.9-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-bin-0:1.25.9-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-docs-0:1.25.9-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-misc-0:1.25.9-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-race-0:1.25.9-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-race-0:1.25.9-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-race-0:1.25.9-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-race-0:1.25.9-1.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-src-0:1.25.9-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • golang-tests-0:1.25.9-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur. Workaround: To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as 'any' or 'interface{}') just before a move operation, refactor the code to use concrete types or explicit pointers instead. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)