This advisory covers several vulnerabilities in the Go Toolset included in Red Hat Enterprise Linux 8. Notably, CVE-2026-27140 allows arbitrary code execution via malicious SWIG file names in cmd/go. Other vulnerabilities include denial of service issues in crypto/tls (CVE-2026-32283) and certificate chain building (CVE-2026-32280), a symlink traversal issue in internal/syscall/unix Root.Chmod (CVE-2026-32282), a no-op interface conversion bypassing overlap checking in cmd/compile (CVE-2026-27144), and possible memory corruption after bound check elimination in cmd/compile (CVE-2026-27143). Red Hat has released an updated Go Toolset package (version 1.25.9+2) for RHEL 8 to address these vulnerabilities. The update is rated as important by Red Hat Product Security.

The vulnerabilities collectively allow for high impact outcomes including arbitrary code execution, denial of service, memory corruption, and potential privilege escalation via symlink traversal. Specifically, arbitrary code execution through malicious SWIG file names can lead to full system compromise. Denial of service vulnerabilities can disrupt services relying on TLS and certificate validation. Memory corruption and bypass of compiler checks may lead to unstable or insecure program behavior. These issues affect the security and stability of systems running the affected Go Toolset versions on Red Hat Enterprise Linux 8.

Red Hat has released an updated Go Toolset package (version 1.25.9+2) for Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply this official security update promptly to remediate the issues. For detailed instructions on applying the update, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Patch status is confirmed as fixed in the updated package.