RHSA-2026:32987MediumCVSS 5.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
June 29, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (1)

📋 Description

CVE-2026-42501 — cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

🎯 Affected products5

  • Red Hat Hardened Images
  • golang-fips1-25-main@aarch64 as a component of Red Hat Hardened Images
  • golang-fips1-25-main@noarch as a component of Red Hat Hardened Images
  • golang-fips1-25-main@src as a component of Red Hat Hardened Images
  • golang-fips1-25-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To verify the integrity of Go module dependencies and detect potential tampering by a malicious proxy, users can revalidate all dependencies of the current module. This process involves removing the existing `go.sum` file and then re-generating and verifying module checksums. Execute the following commands in your module's root directory: ```bash rm go.sum go mod tidy go mod verify ``` This operation will re-download and re-verify all module dependencies. Be aware that this may affect your local module cache and could require re-building projects.

🔗 References (5)