Read the docs
TI-2026-69840 Aliases CVE-2026-97031GHSA-hq7w-2xrq-wp2j

Memory exhaustion in Go crypto/tls via malformed ECH extensions

Priority MEDIUM 40CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 33 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

The Go standard library crypto/tls package in versions before 1.26.9 and from 1.27.0-0 before 1.27.2 accepts multiple ECH outer extension references, which RFC 9849 does not permit (CWE-405). A remote, unauthenticated attacker can send a crafted packet that exhausts memory in the server process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00716 53rd percentileScored 2026-11-07
Fix Partial crypto/tls (Go standard library): 1.26.9, 1.27.2Red Hat: 71 advisoriesRed Hat: 33 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycrypto/tlsbefore 1.26.9; 1.27.0-0 to before 1.27.21.26.9, 1.27.2Patch availableCNA
  • crypto/tls VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*——Go standard library

Remediation

Update the Go standard library to version 1.26.9 or 1.27.2. Red Hat advisories that fix it include RHSA-2026:95518, RHSA-2026:95519 and RHSA-2026:95234. Red Hat lists no fix available for Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat Ceph Storage 7, 8 and 9, and no fix planned for OpenShift Pipelines.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA crypto/tls (Go standard library) Fixed in 1.26.9, 1.27.2

Red Hat 71 advisories

  • RHSA-2026:95518 Released 2026-11-05 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream (v. 9) delve-1.26.1-2.el9_8
  • RHSA-2026:95519 Released 2026-11-05 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream (v. 10) delve-1.26.1-3.el10_2
  • RHSA-2026:95234 Released 2026-11-04 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-lfs-2.13.3-3.el8_4.6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) git-lfs-2.13.3-3.el8_4.6
Show 68 more Red Hat advisories
  • RHSA-2026:95014 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.158.0-2.el9_6
  • RHSA-2026:95015 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.158.0-2.el9_4
  • RHSA-2026:95016 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.158.0-2.el10_0
  • RHSA-2026:93617 Released 2026-11-02 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.158.0-2.el9_8
  • RHSA-2026:93596 Released 2026-11-02 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.158.0-2.el10_2
  • RHSA-2026:92859 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92861 Released 2026-10-29 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
  • RHSA-2026:92858 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92860 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.18 security update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92621 Released 2026-10-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.9-3.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor-1.6.9-3.el9ap
  • RHSA-2026:92622 Released 2026-10-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.7 for RHEL 10 receptor-1.6.9-3.el10ap
    • Red Hat Ansible Automation Platform 2.7 for RHEL 9 receptor-1.6.9-3.el9ap
  • RHSA-2026:92516 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.4.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92509 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.3.9
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92497 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.2.11
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92480 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.1.14
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92451 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.0.17
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92372 Released 2026-10-29 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) osbuild-composer-76.1-10.el9_2, osbuild-composer-core-76.1-10.el9_2, osbuild-composer-dnf-json-76.1-10.el9_2 +1
  • RHSA-2026:92217 Released 2026-10-29 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) rhc-1:0.2.0-6.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) rhc-1:0.2.0-6.el8_4.2
  • RHSA-2026:91958 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.7, osbuild-composer-core-101.3-4.el9_4.7, osbuild-composer-worker-101.3-4.el9_4.7
  • RHSA-2026:91646 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-13.el10_0, osbuild-composer-core-134.1-13.el10_0, osbuild-composer-worker-134.1-13.el10_0
  • RHSA-2026:91587 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) osbuild-composer-132.2-13.el9_6, osbuild-composer-core-132.2-13.el9_6, osbuild-composer-worker-132.2-13.el9_6
  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:90726 Released 2026-10-27 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) rhc-1:0.2.2-1.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) rhc-1:0.2.2-1.el8_8.3
  • RHSA-2026:90725 Released 2026-10-27 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) rhc-1:0.2.1-14.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) rhc-1:0.2.1-14.el8_6.1
  • RHSA-2026:89933 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) delve-1.26.1-1.el9_6.2
  • RHSA-2026:90332 Released 2026-10-26 · Red Hat rating Important
    RHOSO 18.0 os-diff security update
    • 9Base-RHOSO-TOOLS-18 golang-github-openstack-k8s-operators-os-diff-0.1.1-18.0.20261021172337.a95ae05.el9ost
    • Red Hat OpenStack Services on OpenShift 18.0 golang-github-openstack-k8s-operators-os-diff-0.1.1-18.0.20261021172337.a95ae05.el9ost
  • RHSA-2026:89914 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) rhc-devel-1:0.2.7-1.el9_6.8
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) rhc-1:0.2.7-1.el9_6.8
  • RHSA-2026:89915 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) rhc-1:0.2.2-1.el9_2.7
  • RHSA-2026:89908 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) rhc-1:0.2.4-9.el9_4.3
  • RHSA-2026:89888 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) delve-1.26.1-1.el9_2.2
  • RHSA-2026:89885 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) delve-1.26.1-1.el9_4.2
  • RHSA-2026:89892 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rhc-1:0.3.2-6.el10_0.2
  • RHSA-2026:89884 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) delve-1.26.1-3.el10_0
  • RHSA-2026:89832 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 10) rhc-1:0.3.8-8.el10_2
  • RHSA-2026:89751 Released 2026-10-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-10.2.6-28.el10_2.8, grafana-selinux-10.2.6-28.el10_2.8
  • RHSA-2026:89740 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 9) rhc-1:0.2.7-16.el9_8
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) rhc-devel-1:0.2.7-16.el9_8
  • RHSA-2026:89744 Released 2026-10-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-23.el9_8.7, grafana-selinux-10.2.6-23.el9_8.7
  • RHSA-2026:89741 Released 2026-10-26 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 8) rhc-1:0.2.5-13.el8_10
  • RHSA-2026:89131 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +6
  • RHSA-2026:89081 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2026:89041 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +7
  • RHSA-2026:89031 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +7
  • RHSA-2026:88396 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana-10.2.6-24.el9_6, grafana-selinux-10.2.6-24.el9_6
  • RHSA-2026:88395 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
  • RHSA-2026:88397 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana-10.2.6-27.el10_0, grafana-selinux-10.2.6-27.el10_0
  • RHSA-2026:88394 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
  • RHSA-2026:88354 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-pcp-5.1.1-17.el9_8.2
  • RHSA-2026:88340 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-7.5.15-12.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-7.5.15-12.el8_8
  • RHSA-2026:88339 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-7.5.11-12.el8_6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-7.5.11-12.el8_6
  • RHSA-2026:88332 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) grafana-9.2.10-29.el9_4, grafana-selinux-9.2.10-29.el9_4
  • RHSA-2026:88316 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-pcp-5.3.0-8.el10_2.2
  • RHSA-2026:88317 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana-pcp-5.3.0-1.el10_0.2
  • RHSA-2026:88280 Released 2026-10-22 · Red Hat rating Important
    golang-github-openprinting-ipp-usb security update
    • Red Hat Enterprise Linux AppStream (v. 10) ipp-usb-0.9.27-7.el10_2.4
  • RHSA-2026:88189 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-5.1.1-19.el8_10
  • RHSA-2026:88188 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-36.el8_10, grafana-selinux-9.2.10-36.el8_10
  • RHSA-2026:87911 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana-pcp-5.1.1-15.el9_6.2
  • RHSA-2026:87732 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) grafana-9.0.9-14.el9_2
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87043 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.10-1.el9_6, golang-1.26.10-1.el9_6, golang-bin-1.26.10-1.el9_6 +5
  • RHSA-2026:87042 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.10-1.el9_4, golang-1.26.10-1.el9_4, golang-bin-1.26.10-1.el9_4 +5
  • RHSA-2026:87041 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.10-1.el9_2, golang-1.26.10-1.el9_2, golang-bin-1.26.10-1.el9_2 +5
  • RHSA-2026:87040 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.10-1.el10_0, golang-1.26.10-1.el10_0, golang-bin-1.26.10-1.el10_0 +5
  • RHSA-2026:86972 Released 2026-10-21 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) grafana-pcp-5.1.1-10.el9_4
  • RHSA-2026:86973 Released 2026-10-21 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) grafana-pcp-5.1.1-5.el9_2.3
  • RHSA-2026:86196 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.10-1.el9_8, golang-1.26.10-1.el9_8, golang-bin-1.26.10-1.el9_8 +5
  • RHSA-2026:86203 Released 2026-10-20 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22
  • RHSA-2026:86093 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.10-1.el10_2, golang-1.26.10-1.el10_2, golang-bin-1.26.10-1.el10_2 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix yet
Red Hat Service Interconnect 2AffectedNo fix yet
streams for Apache Kafka 3AffectedNo fix yet
9Base-RHOSO-TOOLS-18Fixed RHSA-2026:90332
Red Hat Ansible Automation Platform 2.6 for RHEL 10Fixed RHSA-2026:92621
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:92621
Red Hat Ansible Automation Platform 2.7 for RHEL 10Fixed RHSA-2026:92622
Red Hat Ansible Automation Platform 2.7 for RHEL 9Fixed RHSA-2026:92622
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:89914
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86093, RHSA-2026:88280, RHSA-2026:88316, RHSA-2026:89751, RHSA-2026:89832, RHSA-2026:93596, RHSA-2026:95519
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86203, RHSA-2026:88188, RHSA-2026:88189, RHSA-2026:89741
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86196, RHSA-2026:88354, RHSA-2026:89740, RHSA-2026:89744, RHSA-2026:93617, RHSA-2026:95518
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:92217, RHSA-2026:95234
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394, RHSA-2026:90725
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395, RHSA-2026:90726
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:86973, RHSA-2026:87041, RHSA-2026:87732, RHSA-2026:89888, RHSA-2026:89915, RHSA-2026:92372
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:86972, RHSA-2026:87042, RHSA-2026:88332, RHSA-2026:89885, RHSA-2026:89908, RHSA-2026:91958, RHSA-2026:95015
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:87040, RHSA-2026:88317, RHSA-2026:88397, RHSA-2026:89884, RHSA-2026:89892, RHSA-2026:91646, RHSA-2026:95016
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:87043, RHSA-2026:87911, RHSA-2026:88396, RHSA-2026:89914, RHSA-2026:89933, RHSA-2026:91587, RHSA-2026:95014
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:92217, RHSA-2026:95234
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394, RHSA-2026:90725
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395, RHSA-2026:90726
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:89740
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:89031, RHSA-2026:89081
Red Hat OpenShift Builds 1.9.2Fixed RHSA-2026:89041, RHSA-2026:89131
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:92451
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:92480
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:92497
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:92509
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:92516
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:90332
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:92858
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:92858
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:92859
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:92860
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:92861
Not affected: 30 products
  • OpenShift Service Mesh 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7 for RHEL 10
  • Red Hat Ansible Automation Platform 2.7 for RHEL 9
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Builds 1.9.2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-97031
  2. 2026-10-09 Alias added: GHSA-hq7w-2xrq-wp2j
  3. 2026-10-10 Affected versions changed · Red Hat
  4. 2026-10-10 CVSS score added · CISA ADP
  5. 2026-10-10 Weakness changed · CISA ADP
  6. 2026-10-10 CISA SSVC decision points changed
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-20 Affected versions changed · Red Hat
  9. 2026-10-21 Fix available: RHSA-2026:86203 · Red Hat
  10. 2026-10-21 Fix available: RHSA-2026:86196 · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:86093 · Red Hat
  12. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:87246 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:87042 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:87040 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:87041 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88189 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88188 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88280 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88316 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:87043 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:88354 · Red Hat
  23. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux AppStream E4S (v.9.4) +3 · Red Hat
  24. 2026-10-24 Fix available: RHSA-2026:87245 · Red Hat
  25. 2026-10-24 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · Red Hat
  26. 2026-10-25 Fix available: RHSA-2026:89081 · Red Hat
  27. 2026-10-25 Fix available: RHSA-2026:89031 · Red Hat
  28. 2026-10-25 Fix available: RHSA-2026:89131 · Red Hat
  29. 2026-10-25 Fix available: RHSA-2026:89041 · Red Hat
  30. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3, Red Hat OpenShift Builds 1.9.2 · Red Hat
  31. 2026-10-26 Fix available: RHSA-2026:89741 · Red Hat
  32. 2026-10-26 Affected versions changed · Red Hat
  33. 2026-10-26 Fix available: RHSA-2026:88397 · Red Hat
  34. 2026-10-26 Fix available: RHSA-2026:89751 · Red Hat
  35. 2026-10-26 Fix available: RHSA-2026:89740 · Red Hat
  36. 2026-10-26 Fix available: RHSA-2026:89744 · Red Hat
  37. 2026-10-26 Fix available: RHSA-2026:89832 · Red Hat
  38. 2026-10-26 Fix available: RHSA-2026:89892 · Red Hat
  39. 2026-10-26 Fix available: RHSA-2026:89888 · Red Hat
  40. 2026-10-26 Fix available: RHSA-2026:89884 · Red Hat
  41. 2026-10-26 Fix available: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
  42. 2026-10-26 Fix available: RHSA-2026:86972 · Red Hat
  43. 2026-10-26 Fix available: RHSA-2026:86973 · Red Hat
  44. 2026-10-26 Fix available: RHSA-2026:87732 · Red Hat
  45. 2026-10-26 Fix available: RHSA-2026:87911 · Red Hat
  46. 2026-10-26 Fix available: RHSA-2026:88332 · Red Hat
  47. 2026-10-26 Fix available: RHSA-2026:88317 · Red Hat
  48. 2026-10-26 Fix available: RHSA-2026:88340 · Red Hat
  49. 2026-10-26 Fix available: RHSA-2026:88339 · Red Hat
  50. 2026-10-26 Fix available: RHSA-2026:88394 · Red Hat
  51. 2026-10-26 Fix available: RHSA-2026:88395 · Red Hat
  52. 2026-10-26 Fix available: RHSA-2026:88396 · Red Hat
  53. 2026-10-26 Fix available: RHSA-2026:89885 · Red Hat
  54. 2026-10-26 Fix available: RHSA-2026:89908 · Red Hat
  55. 2026-10-26 Fix available: RHSA-2026:89914 · Red Hat
  56. 2026-10-26 Fix available: RHSA-2026:89915 · Red Hat
  57. 2026-10-26 Fix available: RHSA-2026:90332 · Red Hat
  58. 2026-10-26 Fix available: 9Base-RHOSO-TOOLS-18, Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat OpenStack Services on OpenShift 18.0 · Red Hat
  59. 2026-10-27 Affected versions changed · Red Hat
  60. 2026-10-27 Affected versions changed · Red Hat
  61. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
  62. 2026-10-29 Fix available: RHSA-2026:89933 · Red Hat
  63. 2026-10-29 Fix available: RHSA-2026:90725 · Red Hat
  64. 2026-10-29 Fix available: RHSA-2026:90726 · Red Hat
  65. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  66. 2026-10-29 Fix available: RHSA-2026:91646 · Red Hat
  67. 2026-10-29 Fix available: RHSA-2026:92372 · Red Hat
  68. 2026-10-29 Affected versions changed · Red Hat
  69. 2026-10-30 Fix available: RHSA-2026:92217 · Red Hat
  70. 2026-10-30 Fix available: RHSA-2026:91587 · Red Hat
  71. 2026-10-30 Fix available: RHSA-2026:91958 · Red Hat
  72. 2026-10-30 Fix available: RHSA-2026:92451 · Red Hat
  73. 2026-10-30 Fix available: RHSA-2026:92509 · Red Hat
  74. 2026-10-30 Fix available: RHSA-2026:92497 · Red Hat
  75. 2026-10-30 Fix available: RHSA-2026:92480 · Red Hat
  76. 2026-10-30 Fix available: RHSA-2026:92622 · Red Hat
  77. 2026-10-30 Fix available: RHSA-2026:92621 · Red Hat
  78. 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
  79. 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
  80. 2026-10-30 Fix available: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.7 for RHEL 10 +9 · Red Hat
  81. 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
  82. 2026-10-30 Fix available: Red Hat OpenShift Service Mesh 3.4, Red Hat Satellite 6.19 for RHEL 9 · Red Hat
  83. 2026-10-31 Fix available: RHSA-2026:92516 · Red Hat
  84. 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
  85. 2026-11-01 Affected versions changed · Red Hat
  86. 2026-11-02 Affected versions changed · Red Hat
  87. 2026-11-02 Affected versions changed · Red Hat
  88. 2026-11-02 Fix available: RHSA-2026:93617 · Red Hat
  89. 2026-11-02 Affected versions changed · Red Hat
  90. 2026-11-03 Fix available: RHSA-2026:93596 · Red Hat
  91. 2026-11-03 Affected versions changed · Red Hat
  92. 2026-11-04 Fix available: RHSA-2026:95015 · Red Hat
  93. 2026-11-04 Fix available: RHSA-2026:95014 · Red Hat
  94. 2026-11-04 Fix available: RHSA-2026:95016 · Red Hat
  95. 2026-11-04 Affected versions changed · Red Hat
  96. 2026-11-05 Affected versions changed · Red Hat
  97. 2026-11-05 Affected versions changed · Red Hat
  98. 2026-11-05 Affected versions changed · Red Hat
  99. 2026-11-06 Affected versions changed · Red Hat
  100. 2026-11-06 Fix available: RHSA-2026:95518 · Red Hat
  101. 2026-11-06 Fix available: RHSA-2026:95234 · Red Hat
  102. 2026-11-06 Fix available: RHSA-2026:95519 · Red Hat
  103. 2026-11-07 EPSS moved to the 50th–90th percentile
  104. 2026-11-08 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences