This advisory covers security fixes for golang-github-openprinting-ipp-usb in Red Hat Enterprise Linux 10.0 EUS. The fixes address three CVEs: CVE-2026-32282, where Root.Chmod in golang's internal syscall package can follow symlinks outside the root directory; CVE-2026-32283, a denial of service vulnerability triggered by multiple TLS 1.3 key update messages in the Go crypto/tls package; and CVE-2026-32280, a denial of service vulnerability in certificate chain building within the Go crypto/x509 package. The component golang-github-openprinting-ipp-usb acts as an HTTP reverse proxy backed by IPP-over-USB connections enabling driverless USB device support. The advisory provides updated packages for multiple architectures and directs users to Red Hat's update article for remediation instructions.

The vulnerabilities could allow an attacker to cause denial of service conditions in Go-based TLS and certificate handling components, potentially disrupting services relying on these libraries. The symlink traversal issue in Root.Chmod could lead to unauthorized file permission changes outside intended directories. The advisory rates the overall security impact as Important, indicating a significant but not critical risk. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated packages for golang-github-openprinting-ipp-usb for Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures. Users should apply these updates promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258 to remediate the vulnerabilities. No additional mitigation steps are indicated beyond applying the provided security update.