Red Hat Security Advisory

RHSA-2026:38995

go-toolset:rhel8 security, bug fix, and enhancement update

Released 2026-07-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22

Fixes 6 records

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9

Quadratic complexity in WordDecoder.DecodeHeader in mime

MEDIUM 40

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4 CWE-407

TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7

Root escape via symlink plus trailing slash in os

LOW 36

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00232 Published 2026-07-08 Partial fix · 1.25.12, 1.26.5 +1 CWE-61

TI-2026-30790 CVE-2026-42507 · GHSA-h3gm-q7m7-mp28

Arbitrary inputs are included in errors without any escaping in net/textproto

LOW 30

When returning errors, functions in the net/textproto package would include its input as part of the error.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0037 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4

TI-2026-30788 CVE-2026-42505 · GHSA-ff52-ph69-cf7x

Invoking Encrypted Client Hello privacy leak in crypto/tls

LOW 30

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00382 Published 2026-07-08 Partial fix · 1.25.12, 1.26.5 +1 CWE-201

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

Inefficient candidate hostname parsing in crypto/x509

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4