This Red Hat security advisory (RHSA-2026:54835) updates Red Hat Hardened Images RPMs, specifically golang1.26 packages, to address six CVEs including CVE-2026-33818 and CVE-2026-56853. The critical issue CVE-2026-56853 involves a flaw in the Go standard library's net/http component where the ReadHeaderTimeout is not properly enforced during unencrypted HTTP/2 connection preface detection. This flaw can be exploited by remote attackers to keep connections open indefinitely, leading to resource exhaustion and Denial of Service (DoS). The advisory lists updated RPM versions (golang1.26-1.26.6-0.1.hum1 and related packages) for aarch64 and x86_64 architectures. Red Hat does not explicitly state the patch status but provides updated packages, indicating a fix is available. No known active exploits have been reported. The advisory includes references to Red Hat's errata and security pages for applying updates.

The primary impact is a high-severity Denial of Service (DoS) vulnerability due to resource exhaustion by maintaining open HTTP/2 connections indefinitely. This can degrade or disrupt service availability on affected systems running the vulnerable golang1.26 packages. No confidentiality or integrity impacts are reported. The vulnerability affects resource allocation and availability, potentially impacting server stability and responsiveness.

Red Hat has released updated RPM packages for golang1.26 (version 1.26.6-0.1.hum1) that address these vulnerabilities. Users should apply these updates promptly to mitigate the risk. Detailed update instructions are available at https://images.redhat.com/. No additional mitigations or workarounds are specified in the advisory. Since this is not a cloud service, remediation is managed by applying the vendor-provided package updates.