TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
RHSA-2026:79720
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-10-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images golang1.26-1.26.9-0.1.hum1@aarch64, golang1.26-1.26.9-0.1.hum1@src, golang1.26-1.26.9-0.1.hum1@x86_64 +14
Fixes 3 records
TI-2026-69835 CVE-2026-94447 · GHSA-cgx4-3g64-rvr7
Checksum verification bypass for golang.org/toolchain in Go cmd/go
Priority LOW 35
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.
TI-2026-69834 CVE-2026-94444 · GHSA-2f4j-3hgj-v9j7
Checksum bypass in Go cmd/go lets attackers substitute a module
Priority LOW 35
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.