Red Hat Security Advisory

RHSA-2026:79715

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-10-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images golang1.27-1.27.2-0.1.hum1@aarch64, golang1.27-1.27.2-0.1.hum1@src, golang1.27-1.27.2-0.1.hum1@x86_64 +14

Fixes 2 records

TI-2026-69835 CVE-2026-94447 · GHSA-cgx4-3g64-rvr7

Checksum verification bypass for golang.org/toolchain in Go cmd/go

LOW 35

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00102 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-354

TI-2026-69834 CVE-2026-94444 · GHSA-2f4j-3hgj-v9j7

Checksum bypass in Go cmd/go lets attackers substitute a module

LOW 35

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00097 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-354