RHSA-2026:23264

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation.

When returning errors, functions in the net/textproto package would include its input as part of the error.

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into t…

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute.