This Red Hat security advisory (RHSA-2026:54836) updates Red Hat Hardened Images RPMs, including golang1.25 packages, to address six CVEs, notably CVE-2026-56853. The CVE-2026-56853 vulnerability exists in the Go standard library's net/http component where the ReadHeaderTimeout is not properly enforced during unencrypted HTTP/2 connection preface detection. This flaw allows remote attackers to keep connections open indefinitely, potentially causing resource exhaustion and Denial of Service (DoS). The advisory lists updated golang1.25 RPMs (version 1.25.13-0.1.hum1) for aarch64 and x86_64 architectures. The advisory does not explicitly state fixed version ranges but provides updated package versions. No exploits in the wild are known. The CVSS score for CVE-2026-56853 is preliminarily rated 7.5 by Red Hat, indicating high severity. Other CVEs addressed are not detailed in this input. The advisory recommends applying the update from https://images.redhat.com/.

The primary impact is a high-severity Denial of Service (DoS) vulnerability (CVE-2026-56853) in the Go net/http library that can be exploited remotely without authentication to exhaust server resources by maintaining open connections indefinitely. This can degrade or disrupt service availability. The advisory addresses multiple CVEs affecting Red Hat Hardened Images RPMs, which may impact systems using these golang1.25 packages. No known active exploitation has been reported.

Red Hat has released updated golang1.25 RPM packages (version 1.25.13-0.1.hum1) that fix the vulnerabilities described in this advisory. Users should apply these updates to affected systems as soon as possible. Detailed update instructions and packages are available at https://images.redhat.com/. No alternative mitigations or workarounds are specified in the advisory. Since this is a packaged update, applying the official fix is the recommended remediation.