Red Hat Security Advisory

RHSA-2026:29980

golang security, bug fix, and enhancement update

Released 2026-06-25 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.4-1.el10_2, golang-1.26.4-1.el10_2, golang-bin-1.26.4-1.el10_2 +5

TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9

MEDIUM 40

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4 CWE-407

TI-2026-30790 CVE-2026-42507 · GHSA-h3gm-q7m7-mp28

LOW 30

When returning errors, functions in the net/textproto package would include its input as part of the error.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0037 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4