This advisory covers multiple security vulnerabilities in the golang packages provided by Red Hat for Enterprise Linux 9. The fixed issues include: CVE-2026-27140, arbitrary code execution via malicious SWIG file names in cmd/go; CVE-2026-27143, possible memory corruption after bound check elimination in cmd/compile; CVE-2026-27144, no-op interface conversion bypassing overlap checking in cmd/compile; CVE-2026-32280, denial of service in certificate chain building in crypto/x509 and crypto/tls; CVE-2026-32282, symlink traversal in internal/syscall/unix Root.Chmod; and CVE-2026-32283, denial of service via multiple TLS 1.3 key update messages in crypto/tls. Red Hat has released updated golang packages (version 1.25.9-1.el9_7) that address these vulnerabilities across supported architectures. The advisory references Red Hat Bugzilla entries and provides links to update instructions.

The vulnerabilities collectively allow for arbitrary code execution, denial of service conditions, memory corruption, and unauthorized file system access via symlink traversal. These issues could potentially be exploited by attackers to disrupt services or execute malicious code on affected systems running vulnerable golang packages. The security impact is rated as important by Red Hat, indicating a high risk to affected systems if unpatched.

Red Hat has released an official security update for golang packages in Red Hat Enterprise Linux 9, specifically version 1.25.9-1.el9_7 and later. Users should apply this update promptly to remediate the vulnerabilities described. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.