RHSA-2026:62405: Important: golang security update
Important: golang security update
Other sources
The golang packages provide the Go programming language compiler.Security Fix(es): encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-binto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-docsto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-miscto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-raceto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-srcto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/golang-teststo a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4.aa - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4.aa - Upgrade
Upgrade
redhat/golang-binto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4.aa - Upgrade
Upgrade
redhat/golang-raceto a version that resolves this vulnerability.Fixed in 1.26.7-1.el9_4.aa
Event History
Frequently Asked Questions
Which deployments are most exposed to the denial-of-service issues?
Deployments that process attacker-controlled ASN.1, XML, URL paths, HTTP/2 traffic, or TLS connections may be exposed, depending on which affected Go standard-library components they use. The advisory identifies denial-of-service conditions in encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml.
Is an application affected simply because Go is installed?
The provided information identifies affected Go packages and standard-library components, but does not state that every installed Go application is exploitable. Exposure depends on whether the application processes the relevant untrusted inputs or network traffic.
What is the impact beyond denial of service?
Most listed fixes address denial of service, but the html/template issue is identified as a cross-site scripting vulnerability. Applications that render attacker-influenced data through html/template may require separate XSS impact assessment.