This advisory covers several security fixes in the golang packages provided by Red Hat for Red Hat Enterprise Linux 8 and 10. The vulnerabilities include CVE-2026-27140 (arbitrary code execution via malicious SWIG file names in cmd/go), CVE-2026-27143 (possible memory corruption after bound check elimination in cmd/compile), CVE-2026-27144 (no-op interface conversion bypassing overlap checking in cmd/compile), CVE-2026-32280 (denial of service in certificate chain building in crypto/x509), CVE-2026-32282 (root.Chmod following symlinks out of root in internal/syscall/unix), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages in crypto/tls). These issues affect the Go toolset and compiler components and have been rated with a high security impact by Red Hat. Updated golang packages have been released to remediate these vulnerabilities.

The vulnerabilities collectively allow for denial of service conditions in TLS and certificate handling, potential arbitrary code execution via malicious SWIG file names, privilege escalation through symlink following in root.Chmod, and possible memory corruption in the compiler. These could impact the security and stability of applications built with or using the affected Go toolset versions on Red Hat Enterprise Linux 8 and 10 systems.

Red Hat has released updated golang packages for Red Hat Enterprise Linux 8 and 10 that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the vendor-provided patches are indicated.