Red Hat Security Advisory: go-toolset:rhel8 security update

The Red Hat security advisory RHSA-2026:22112 details multiple vulnerabilities in the Go Toolset (golang) provided in Red Hat Enterprise Linux 8. The issues include denial of service via pathological email address parsing (CVE-2026-42499), integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501), cross-site scripting via improper URL escaping in meta tag content (CVE-2026-39823), arbitrary file overwrite via symlink attack (CVE-2026-39819), denial of service via malformed HTTP/2 SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814), denial of service via crafted email inputs (CVE-2026-39820), denial of service via long CNAME response in LookupCNAME (CVE-2026-33811), reverse proxy forwarding hidden query parameters potentially bypassing security controls (CVE-2026-39825), arbitrary file write via malicious archive extraction (CVE-2026-39817), cross-site scripting due to incorrect script tag escaping (CVE-2026-39826), and denial of service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836). Red Hat has released updated packages to address these vulnerabilities, including an update to Go version 1.25.10+1 for RHEL 8.10. The advisory provides references to CVE details and instructions for applying the update.

These vulnerabilities collectively could allow attackers to cause denial of service conditions, bypass integrity checks, perform cross-site scripting attacks, overwrite arbitrary files, and bypass security controls in applications using the affected Go components. The impact affects the confidentiality, integrity, and availability of systems running vulnerable versions of the Go Toolset on Red Hat Enterprise Linux 8. The advisory rates the security impact as Important (high severity).

Red Hat has released an official security update for the go-toolset module in Red Hat Enterprise Linux 8 that addresses all listed vulnerabilities. Users should apply the update to upgrade to Go version 1.25.10+1 or later as provided by Red Hat. Detailed instructions and updated packages are available at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official update.