Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This Red Hat security advisory announces an update to the Red Hat Hardened Images RPMs, particularly the golang1.27 packages, to version 1.27.3-1.hum1 across multiple architectures (aarch64, s390x, x86_64, and noarch). The update addresses three CVEs: CVE-2026-94440, CVE-2026-97030, and CVE-2026-111943. The advisory does not detail the nature of these vulnerabilities but categorizes them with CWEs including CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-79 (Cross-site Scripting), and CWE-295 (Improper Certificate Validation). The update is classified as a bug fix and enhancement update for hardened images. No known exploits are reported in the wild, and no direct patch links are provided beyond the advisory references.

The vulnerabilities addressed are rated as high severity by Red Hat. They potentially affect the golang1.27 packages within Red Hat Hardened Images. The specific impacts are not detailed, but the associated CWEs suggest risks related to resource management, cross-site scripting, and certificate validation issues. No known exploitation in the wild has been reported at the time of the advisory.

Red Hat has released updated golang1.27 RPM packages (version 1.27.3-1.hum1) that include fixes for the identified vulnerabilities. Users of Red Hat Hardened Images should apply these updates as per Red Hat's instructions available at https://images.redhat.com/. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor advisories indicate that no action is required or that the issue is already mitigated.