The golang packages for Red Hat Enterprise Linux contain several security flaws: CVE-2026-27140 allows arbitrary code execution via malicious SWIG file names in cmd/go; CVE-2026-27143 involves possible memory corruption after bound check elimination in cmd/compile; CVE-2026-27144 concerns no-op interface conversion bypassing overlap checking in cmd/compile; CVE-2026-32280 and CVE-2026-32283 are denial of service vulnerabilities in crypto/x509 and crypto/tls related to certificate chain building and TLS 1.3 key update messages respectively; CVE-2026-32282 is a symlink traversal issue in internal/syscall/unix Root.Chmod. Red Hat has issued security advisories RHSA-2026:16021 and RHSA-2026:10704 detailing these fixes and providing updated packages for affected Red Hat Enterprise Linux versions and architectures.

These vulnerabilities collectively allow for denial of service conditions, potential arbitrary code execution, and unauthorized filesystem access via symlink traversal. The arbitrary code execution vulnerability (CVE-2026-27140) is particularly critical as it could allow attackers to execute malicious code via crafted SWIG file names. Denial of service vulnerabilities could disrupt services relying on Go's crypto/tls and crypto/x509 packages. Memory corruption and interface conversion issues could lead to unstable or exploitable program behavior. The symlink traversal vulnerability could allow unauthorized modification of files outside intended directories.

Red Hat has released official security updates that address all listed vulnerabilities. Users should apply the updated golang packages provided in Red Hat Enterprise Linux 8 and 9.6 Extended Update Support and related releases. Detailed instructions and updated packages are available in the Red Hat advisories RHSA-2026:16021 and RHSA-2026:10704 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will mitigate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.