The golang-github-openprinting-ipp-usb package in Red Hat Enterprise Linux 10.0 Extended Update Support contains multiple security vulnerabilities. CVE-2026-32282 is a symlink traversal vulnerability in the internal syscall unix Root.Chmod function that can follow symlinks outside the root directory. CVE-2026-32283 is a denial of service vulnerability triggered by multiple TLS 1.3 key update messages in the Go crypto/tls package. CVE-2026-32280 is another denial of service vulnerability in certificate chain building within Go's crypto/x509 and crypto/tls packages. These issues affect the golang-github-openprinting-ipp-usb package, which acts as an HTTP reverse proxy for IPP-over-USB devices. Red Hat has released an update (RHSA-2026:19550) to address these vulnerabilities in the affected packages for multiple architectures under Red Hat Enterprise Linux 10.0 Extended Update Support.

The vulnerabilities include a symlink traversal issue that could allow unauthorized file system access beyond intended boundaries, and denial of service conditions caused by malformed TLS key update messages and certificate chain processing. These could lead to service disruption or potential privilege escalation depending on exploitation context. The issues affect the golang-github-openprinting-ipp-usb package used for driverless USB device support via IPP-over-USB. Red Hat rates the security impact as Important, indicating a high severity level but not critical.

Red Hat has released an official security update (RHSA-2026:19550) that addresses these vulnerabilities in the golang-github-openprinting-ipp-usb package for Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply this update promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.