RLSA-2026:95638: Important: go-toolset:rhel8 security update

Q: Which installed software should be checked for exposure?

The advisory lists rocky-linux/golang and rocky-linux/delve. Systems with either of these installed should be reviewed for the security update.

Q: What attacker position is relevant to this issue?

The issue involves man-in-the-middle attacks using untrusted intermediate certificates. Exposure is therefore relevant where affected Go certificate validation is relied upon during connections that an attacker could intercept.

Published Nov 6, 2026

Updated

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

2 affected componentsFixes available

rocky-linux/delve<0:1.26.1-2.module+el8.10.0+40408+b9bc4117

0:1.26.1-2.module+el8.10.0+40408+b9bc4117

rocky-linux/golang<0:1.26.10-1.module+el8.10.0+40387+102242d5

0:1.26.10-1.module+el8.10.0+40387+102242d5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/delve to a version that resolves this vulnerability.
Fixed in 0:1.26.1-2.module+el8.10.0+40408+b9bc4117
Upgrade
Upgrade rocky-linux/golang to a version that resolves this vulnerability.
Fixed in 0:1.26.10-1.module+el8.10.0+40387+102242d5

Event History

Nov 6, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111943

Frequently Asked Questions

Which installed software should be checked for exposure?

The advisory lists rocky-linux/golang and rocky-linux/delve. Systems with either of these installed should be reviewed for the security update.

What attacker position is relevant to this issue?

The issue involves man-in-the-middle attacks using untrusted intermediate certificates. Exposure is therefore relevant where affected Go certificate validation is relied upon during connections that an attacker could intercept.

RLSA-2026:95638: Important: go-toolset:rhel8 security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which installed software should be checked for exposure?

What attacker position is relevant to this issue?

Company

Resources

Contact

Frequently Asked Questions

Which installed software should be checked for exposure?

What attacker position is relevant to this issue?