The golang-github-openprinting-ipp-usb package in Red Hat Enterprise Linux 10 acts as an HTTP reverse proxy enabling driverless support for USB devices using the IPP-over-USB protocol. Two security issues are addressed: CVE-2026-27137, which concerns improper enforcement of email constraints in the crypto/x509 package, and CVE-2026-25679, which involves incorrect parsing of IPv6 host literals in the net/url package. These flaws could potentially affect the security of applications relying on these Go libraries. Red Hat has released updated packages to remediate these vulnerabilities across multiple supported architectures and versions of Red Hat Enterprise Linux 10.

The vulnerabilities affect the golang-github-openprinting-ipp-usb package and underlying Go libraries (crypto/x509 and net/url) used in Red Hat Enterprise Linux 10. Improper enforcement of email constraints and incorrect IPv6 parsing could lead to security issues in applications that depend on these libraries, potentially impacting validation and network communication. The advisory rates the security impact as Important (high severity). There are no reports of known exploits in the wild at this time.

Red Hat has released updated packages for golang-github-openprinting-ipp-usb that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 10 versions should apply the provided security update as detailed in the Red Hat advisory RHSA-2026:19049 and the referenced article https://access.redhat.com/articles/11258. Applying this update is the recommended remediation. No additional mitigations or workarounds are specified by the vendor.