This advisory covers several security fixes in the golang packages distributed by Red Hat, including CVE-2026-27140 (arbitrary code execution via malicious SWIG file names), CVE-2026-27143 (possible memory corruption after bound check elimination), CVE-2026-27144 (no-op interface conversion bypassing overlap checking), CVE-2026-32280 (denial of service in certificate chain building), CVE-2026-32282 (Root.Chmod following symlinks out of root), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages). These vulnerabilities affect the Go compiler, crypto/tls, crypto/x509, and related components. Red Hat has issued updated packages for Red Hat Enterprise Linux 9 and container images for OpenShift Container Platform 4.17 to address these issues.

The vulnerabilities include the potential for arbitrary code execution, denial of service conditions, and memory corruption. Specifically, malicious SWIG file names can lead to code execution, TLS and certificate chain handling flaws can cause denial of service, and compiler bugs may result in memory corruption or bypass of safety checks. These issues could impact the security and stability of systems running affected versions of golang and related Red Hat products.

Red Hat has released updated golang packages for Red Hat Enterprise Linux 9 (version 1.25.9+2) and updated container images for OpenShift Container Platform 4.17.55 that address these vulnerabilities. Users should apply these official updates as soon as possible. Detailed instructions for applying the updates are available in the Red Hat advisories and documentation. No additional mitigation steps are indicated beyond applying the provided patches.