p PatchFirst

PatchFirst · Latest vulnerabilities

golang vulnerabilities

Vulnerabilities published for golang in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 15

  1. RLSA-2026:86093

    High · CVSS 7.5Fix available

    Important: golang security, bug fix, and enhancement update

    The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [rhel-10.2.z] (

    golangOperating systems
    • Update to 0:1.26.10-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. RLSA-2026:60306

    High · CVSS 8.1Fix available

    Important: golang security, bug fix, and enhancement update

    The golang packages provide the Go programming language compiler. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) *

    golangOperating systems
    • Update to 0:1.26.7-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. RLSA-2026:22120

    High · CVSS 7.5Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed S

    golangOperating systems
    • Update to 0:1.26.3-4.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. RLSA-2026:37436

    High · CVSS 8.2Fix available

    Important: golang security, bug fix, and enhancement update

    The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [rhel-10.2.z] (JIRA:Rocky Linux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.26.5-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. RLSA-2026:29980

    Medium · CVSS 5.3Fix available

    Moderate: golang security, bug fix, and enhancement update

    The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [rhel-10.2.z] (JIRA:Rocky Linux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.26.4-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. RLSA-2026:19022

    High · CVSS 7.5Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.26.2-2.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. RLSA-2026:10217

    Critical · CVSS 9Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: p

    golangOperating systems
    • Update to 0:1.25.9-3.el10_1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. RLSA-2026:5941

    High · CVSS 8.6Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.25.8-1.el10_1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. RLSA-2026:2706

    High · CVSS 7.5Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.25.7-1.el10_1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. RLSA-2026:0922

    High · CVSS 7.5Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.25.5-1.el10_1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. RLSA-2025:21816

    High · CVSS 7.5Fix available

    Moderate: delve and golang security update

    The Go Programming Language. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.25.3-1.el10_1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. RLSA-2025:8477

    Medium · CVSS 5.4Fix available

    Moderate: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.23.9-1.el10_0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. RLSA-2025:7466

    Medium · CVSS 5.9Fix available

    Moderate: delve and golang security update

    Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in cry

    golangOperating systems
    • Update to 0:1.23.7-1.el10_0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. RLSA-2025:13941

    High · CVSS 8.6Fix available

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.24.6-1.el10_0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. RLSA-2025:10677

    Medium · CVSS 6.8Fix available

    Moderate: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    golangOperating systems
    • Update to 0:1.24.4-1.el10_0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →