The golang packages for Red Hat Enterprise Linux 9 contain vulnerabilities in the crypto/x509 and net/url packages. CVE-2026-27137 involves incorrect enforcement of email constraints in the crypto/x509 package, and CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package. Red Hat has released an update to golang version 1.26.2-1.el9_8 that addresses these issues. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. The vendor advisory confirms the availability of a fix and provides detailed package versions for remediation.

These vulnerabilities could lead to incorrect handling of email constraints and IPv6 host literals within applications using the affected golang packages, potentially causing security policy bypass or parsing errors. The exact impact is not detailed in the advisory, and no known exploits are reported in the wild. The issues affect the Go compiler and runtime components distributed by Red Hat Enterprise Linux 9.

Red Hat has released an official security update for golang in Red Hat Enterprise Linux 9, updating the package to version 1.26.2-1.el9_8. Users should apply this update promptly to remediate the vulnerabilities. Detailed instructions and package downloads are available in the Red Hat advisory RHSA-2026:19181. No additional mitigation steps are indicated by the vendor.