Red Hat Security Advisory: golang security update
The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The primary vulnerability, CVE-2026-27137, is a certificate validation flaw in the golang crypto/x509 module used by Red Hat OpenShift GitOps and related components. It improperly enforces email constraints in certificates containing multiple email address constraints with common local parts but differing domains, only considering the last constraint. This can allow an attacker to spoof trusted entities by bypassing certificate validation. Additional vulnerabilities fixed include denial of service issues in golang crypto/tls and a symlink following issue in internal syscall handling. Red Hat has released updated packages for Red Hat Enterprise Linux 9.6 Extended Update Support to remediate these issues. The vendor advisory provides detailed patch information and confirms the fixes.
Potential Impact
The incorrect enforcement of email constraints in certificate validation can allow an attacker to bypass protection mechanisms, potentially causing the product to trust malicious or spoofed certificates. This may lead to connecting to malicious hosts or accepting spoofed data under the guise of trusted entities. The denial of service vulnerabilities in TLS and certificate chain processing could disrupt service availability. Overall, the impact is rated as important (high severity) by Red Hat, with no confidentiality or integrity loss reported but significant availability impact possible.
Mitigation Recommendations
Red Hat has released official security updates for affected versions of Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No alternative mitigations meeting Red Hat's criteria are currently available. Since this is not a cloud service, remediation requires applying the vendor-provided patches. There are no known exploits in the wild, so applying the official fixes is the recommended course of action.
Red Hat Security Advisory: golang security update
Description
The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) * golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The primary vulnerability, CVE-2026-27137, is a certificate validation flaw in the golang crypto/x509 module used by Red Hat OpenShift GitOps and related components. It improperly enforces email constraints in certificates containing multiple email address constraints with common local parts but differing domains, only considering the last constraint. This can allow an attacker to spoof trusted entities by bypassing certificate validation. Additional vulnerabilities fixed include denial of service issues in golang crypto/tls and a symlink following issue in internal syscall handling. Red Hat has released updated packages for Red Hat Enterprise Linux 9.6 Extended Update Support to remediate these issues. The vendor advisory provides detailed patch information and confirms the fixes.
Potential Impact
The incorrect enforcement of email constraints in certificate validation can allow an attacker to bypass protection mechanisms, potentially causing the product to trust malicious or spoofed certificates. This may lead to connecting to malicious hosts or accepting spoofed data under the guise of trusted entities. The denial of service vulnerabilities in TLS and certificate chain processing could disrupt service availability. Overall, the impact is rated as important (high severity) by Red Hat, with no confidentiality or integrity loss reported but significant availability impact possible.
Mitigation Recommendations
Red Hat has released official security updates for affected versions of Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No alternative mitigations meeting Red Hat's criteria are currently available. Since this is not a cloud service, remediation requires applying the vendor-provided patches. There are no known exploits in the wild, so applying the official fixes is the recommended course of action.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:9699
- Cve Count
- 1
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a18be66e29bf47b503867f7
Added to database: 05/28/2026, 22:15:02 UTC
Last enriched: 08/15/2026, 00:00:33 UTC
Last updated: 09/14/2026, 00:46:51 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.