Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

The vulnerability CVE-2026-42501 affects the Go command (cmd/go) in Red Hat Hardened Images RPMs. It permits a malicious module proxy to bypass checksum validation, which could result in the execution of untrusted Go toolchains. This flaw impacts Red Hat products using the Go command configured with untrusted module proxies or checksum databases. Red Hat has issued security updates including golang-fips1.25-1.25.9-0.1.1.hum1 RPMs for multiple architectures to fix this vulnerability. Users should revalidate module dependencies by regenerating the go.sum file as part of mitigation.

If exploited, this vulnerability could allow execution of untrusted Go toolchains by bypassing checksum validation when interacting with a compromised module proxy. This could undermine the integrity of Go module dependencies in affected Red Hat Hardened Images, potentially leading to supply chain compromise or execution of malicious code during Go builds.

Red Hat has released updated golang-fips1.25 RPM packages (version 1.25.9-0.1.1.hum1) that address CVE-2026-42501. Users should apply these official security updates promptly. Additionally, users are advised to revalidate module dependencies by regenerating the go.sum file to ensure integrity of Go modules. No other mitigation actions are specified by Red Hat.