Red Hat has released a security advisory (RHSA-2026:16021) addressing multiple vulnerabilities in the golang packages for Red Hat Enterprise Linux 9.6 Extended Update Support. The fixed issues include CVE-2026-27140 (arbitrary code execution via malicious SWIG file names in cmd/go), CVE-2026-27143 (possible memory corruption after bound check elimination in cmd/compile), CVE-2026-27144 (no-op interface conversion bypassing overlap checking in cmd/compile), CVE-2026-32280 (denial of service in certificate chain building in crypto/x509), CVE-2026-32282 (Root.Chmod following symlinks out of root in internal/syscall/unix), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages in crypto/tls). These vulnerabilities impact the Go compiler and related tools distributed by Red Hat. The advisory provides updated package versions to remediate these issues.

The vulnerabilities collectively allow for arbitrary code execution, denial of service conditions, memory corruption, and unintended file system access via symlink traversal. Specifically, CVE-2026-27140 enables arbitrary code execution through malicious SWIG file names. CVE-2026-32283 and CVE-2026-32280 can cause denial of service in TLS and certificate chain processing. CVE-2026-32282 allows Root.Chmod to follow symlinks outside the intended root directory, potentially leading to unauthorized file modifications. These issues could affect the security and stability of systems running the affected golang packages.

Red Hat has released updated golang packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:16021 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.