Skip to content
Heist/ feed
UnratedFix available

Important: go-toolset:rhel8 security update

Type: advisorySource: OSV1 source record

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836) For more details about the security issue(s), including the impact, a CVSS score, acknowl

Announced Source revision 1
Original source ↗

ALSA-2026:22112

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:ALSA-2026:22112

delve

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.2-1.module_el8.10.0+4074+24330916

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

go-toolset

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

golang

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

golang-bin

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

golang-docs

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

golang-misc

Source reference: /affected/5/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/5/ranges

Prerequisites
Not stated in this record

golang-race

Source reference: /affected/6/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/6/ranges

Prerequisites
Not stated in this record

golang-src

Source reference: /affected/7/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/7/ranges

Prerequisites
Not stated in this record

golang-tests

Source reference: /affected/8/package/name

Affected versions
Not stated in this record
Fixed versions
1.25.10-1.module_el8.10.0+4187+c45165c4

Source reference: /affected/8/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.2-1.module_el8.10.0+4074+24330916"
          }
        ]
      }
    ],
    "package": {
      "name": "delve",
      "purl": "pkg:rpm/almalinux/delve",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "go-toolset",
      "purl": "pkg:rpm/almalinux/go-toolset",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang",
      "purl": "pkg:rpm/almalinux/golang",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-bin",
      "purl": "pkg:rpm/almalinux/golang-bin",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-docs",
      "purl": "pkg:rpm/almalinux/golang-docs",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-misc",
      "purl": "pkg:rpm/almalinux/golang-misc",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-race",
      "purl": "pkg:rpm/almalinux/golang-race",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-src",
      "purl": "pkg:rpm/almalinux/golang-src",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.10-1.module_el8.10.0+4187+c45165c4"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-tests",
      "purl": "pkg:rpm/almalinux/golang-tests",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:22112.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#37242 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement