RHSA-2026:66561

Vulnerability from csaf_redhat - Published: 2026-09-11 02:00 - Updated: 2026-10-03 15:56
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: golang1.27: * golang1.27-1.27.1-0.1.hum1 (aarch64, x86_64) * golang1.27-bin-1.27.1-0.1.hum1 (aarch64, x86_64) * golang1.27-docs-1.27.1-0.1.hum1 (noarch) * golang1.27-misc-1.27.1-0.1.hum1 (noarch) * golang1.27-src-1.27.1-0.1.hum1 (noarch) * golang1.27-tests-1.27.1-0.1.hum1 (noarch) * golang1.27-1.27.1-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-27136

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-39817

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.

5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-39819

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the 'go bug' command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.

4.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-39827

A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-39834

A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-39835

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Important
CVE-2026-42500

A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP (Bitmap) file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial of Service (DoS). This could make the affected application unavailable to legitimate users.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-42502

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
CVE-2026-46598

A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial of Service (DoS) for the affected component.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Fixed 13 products, the same list as for CVE-2026-27136
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:66561 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-42500 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-46598 external
https://access.redhat.com/security/cve/CVE-2026-42502 external
https://access.redhat.com/security/cve/CVE-2026-39835 external
https://access.redhat.com/security/cve/CVE-2026-39834 external
https://access.redhat.com/security/cve/CVE-2026-39827 external
https://access.redhat.com/security/cve/CVE-2026-27136 external
https://access.redhat.com/security/cve/CVE-2026-39817 external
https://access.redhat.com/security/cve/CVE-2026-39819 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-27136 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480757 external
https://www.cve.org/CVERecord?id=CVE-2026-27136 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27136 external
https://go.dev/cl/781685 external
https://go.dev/issue/79575 external
https://groups.google.com/g/golang-announce/c/iI-… external
https://pkg.go.dev/vuln/GO-2026-5030 external
https://access.redhat.com/security/cve/CVE-2026-39817 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467825 external
https://www.cve.org/CVERecord?id=CVE-2026-39817 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39817 external
https://go.dev/cl/767520 external
https://go.dev/issue/78778 external
https://groups.google.com/g/golang-announce/c/qcC… external
https://pkg.go.dev/vuln/GO-2026-4979 external
https://access.redhat.com/security/cve/CVE-2026-39819 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467813 external
https://www.cve.org/CVERecord?id=CVE-2026-39819 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39819 external
https://go.dev/cl/763882 external
https://go.dev/issue/78584 external
https://pkg.go.dev/vuln/GO-2026-4978 external
https://access.redhat.com/security/cve/CVE-2026-39827 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480682 external
https://www.cve.org/CVERecord?id=CVE-2026-39827 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39827 external
https://go.dev/cl/781320 external
https://go.dev/issue/35127 external
https://groups.google.com/g/golang-announce/c/a08… external
https://pkg.go.dev/vuln/GO-2026-5016 external
https://access.redhat.com/security/cve/CVE-2026-39834 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480676 external
https://www.cve.org/CVERecord?id=CVE-2026-39834 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39834 external
https://go.dev/cl/781663 external
https://go.dev/issue/79567 external
https://pkg.go.dev/vuln/GO-2026-5020 external
https://access.redhat.com/security/cve/CVE-2026-39835 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480680 external
https://www.cve.org/CVERecord?id=CVE-2026-39835 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39835 external
https://go.dev/cl/781660 external
https://go.dev/issue/79563 external
https://pkg.go.dev/vuln/GO-2026-5015 external
https://access.redhat.com/security/cve/CVE-2026-42500 self
https://bugzilla.redhat.com/show_bug.cgi?id=2483431 external
https://www.cve.org/CVERecord?id=CVE-2026-42500 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42500 external
https://go.dev/cl/781500 external
https://go.dev/issue/79576 external
https://groups.google.com/g/golang-announce/c/uhY… external
https://pkg.go.dev/vuln/GO-2026-5031 external
https://access.redhat.com/security/cve/CVE-2026-42502 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480762 external
https://www.cve.org/CVERecord?id=CVE-2026-42502 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42502 external
https://go.dev/cl/781701 external
https://go.dev/issue/79572 external
https://pkg.go.dev/vuln/GO-2026-5027 external
https://access.redhat.com/security/cve/CVE-2026-46598 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480679 external
https://www.cve.org/CVERecord?id=CVE-2026-46598 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46598 external
https://go.dev/cl/781360 external
https://go.dev/issue/79596 external
https://pkg.go.dev/vuln/GO-2026-5033 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngolang1.27:\n  * golang1.27-1.27.1-0.1.hum1 (aarch64, x86_64)\n  * golang1.27-bin-1.27.1-0.1.hum1 (aarch64, x86_64)\n  * golang1.27-docs-1.27.1-0.1.hum1 (noarch)\n  * golang1.27-misc-1.27.1-0.1.hum1 (noarch)\n  * golang1.27-src-1.27.1-0.1.hum1 (noarch)\n  * golang1.27-tests-1.27.1-0.1.hum1 (noarch)\n  * golang1.27-1.27.1-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66561",
        "url": "https://access.redhat.com/errata/RHSA-2026:66561"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42500",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42500"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46598",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46598"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39835"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39834",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39834"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39827",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39827"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27136"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39817",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39817"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39819",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39819"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66561.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-03T15:56:07+00:00",
      "generator": {
        "date": "2026-10-03T15:56:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:66561",
      "initial_release_date": "2026-09-11T02:00:14+00:00",
      "revision_history": [
        {
          "date": "2026-09-11T02:00:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-18T19:07:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-03T15:56:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.27-0:1.27.1-0.1.hum1@aarch64",
                "product": {
                  "name": "golang1.27-0:1.27.1-0.1.hum1@aarch64",
                  "product_id": "golang1.27-0:1.27.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27@1.27.1-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
                "product": {
                  "name": "golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
                  "product_id": "golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-bin@1.27.1-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.27-0:1.27.1-0.1.hum1@src",
                "product": {
                  "name": "golang1.27-0:1.27.1-0.1.hum1@src",
                  "product_id": "golang1.27-0:1.27.1-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27@1.27.1-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.27-0:1.27.1-0.1.hum1@x86_64",
                "product": {
                  "name": "golang1.27-0:1.27.1-0.1.hum1@x86_64",
                  "product_id": "golang1.27-0:1.27.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27@1.27.1-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
                "product": {
                  "name": "golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
                  "product_id": "golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-bin@1.27.1-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-docs@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-docs@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-misc@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-misc@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-src@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-src@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-tests@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang1.27-tests@1.27.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-0:1.27.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64"
        },
        "product_reference": "golang1.27-0:1.27.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-0:1.27.1-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src"
        },
        "product_reference": "golang1.27-0:1.27.1-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-0:1.27.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64"
        },
        "product_reference": "golang1.27-0:1.27.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-bin-0:1.27.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64"
        },
        "product_reference": "golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-bin-0:1.27.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64"
        },
        "product_reference": "golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27136",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:00:56.609820+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781685",
          "url": "https://go.dev/cl/781685"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79575",
          "url": "https://go.dev/issue/79575"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5030",
          "url": "https://pkg.go.dev/vuln/GO-2026-5030"
        }
      ],
      "release_date": "2026-05-22T15:01:22.111000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "cve": "CVE-2026-39817",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-05-07T20:01:43.510043+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \"go tool pack\" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the \"pack\" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39817",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39817"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767520",
          "url": "https://go.dev/cl/767520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78778",
          "url": "https://go.dev/issue/78778"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4979",
          "url": "https://pkg.go.dev/vuln/GO-2026-4979"
        }
      ],
      "release_date": "2026-05-07T19:41:18.993000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction"
    },
    {
      "cve": "CVE-2026-39819",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-05-07T20:01:04.403877+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \u0027go bug\u0027 command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system\u0027s temporary directory could exploit this by creating a symbolic link (symlink) with one of these predictable names. This would cause the \u0027go bug\u0027 command to overwrite the target of the symlink, potentially leading to arbitrary file overwrite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39819"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763882",
          "url": "https://go.dev/cl/763882"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78584",
          "url": "https://go.dev/issue/78584"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4978",
          "url": "https://pkg.go.dev/vuln/GO-2026-4978"
        }
      ],
      "release_date": "2026-05-07T19:41:18.849000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cmd/go: golang: Go \u0027go bug\u0027 command: Arbitrary file overwrite via symlink attack"
    },
    {
      "cve": "CVE-2026-39827",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-05-22T04:01:32.990556+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480682"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the server process and affecting all connected users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480682",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480682"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39827",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781320",
          "url": "https://go.dev/cl/781320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/35127",
          "url": "https://go.dev/issue/35127"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5016",
          "url": "https://pkg.go.dev/vuln/GO-2026-5016"
        }
      ],
      "release_date": "2026-05-22T02:31:27.064000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings"
    },
    {
      "cve": "CVE-2026-39834",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-05-22T04:01:15.681060+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480676"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnerability causes the write loop to spin indefinitely, continuously sending empty packets without making progress. The primary consequence is a denial of service (DoS), as the affected system consumes resources and prevents legitimate data transfer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480676",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480676"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781663",
          "url": "https://go.dev/cl/781663"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79567",
          "url": "https://go.dev/issue/79567"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5020",
          "url": "https://pkg.go.dev/vuln/GO-2026-5020"
        }
      ],
      "release_date": "2026-05-22T02:31:27.540000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write"
    },
    {
      "cve": "CVE-2026-39835",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-05-22T04:01:27.279943+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480680"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480680",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781660",
          "url": "https://go.dev/cl/781660"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79563",
          "url": "https://go.dev/issue/79563"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5015",
          "url": "https://pkg.go.dev/vuln/GO-2026-5015"
        }
      ],
      "release_date": "2026-05-22T02:31:26.982000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "cve": "CVE-2026-42500",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-05-29T20:01:24.302313+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/image/bmp. A remote attacker could exploit this vulnerability by providing a specially crafted paletted BMP (Bitmap) file. Decoding this file with an out-of-range palette index causes the application to panic when accessing invalid image pixels, leading to a Denial of Service (DoS). This could make the affected application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/image/bmp: golang: golang.org/x/image/bmp: Denial of Service via out-of-range palette index in BMP decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in golang.org/x/image/bmp. Decoding a specially crafted paletted BMP file with an out-of-range palette index causes an unrecoverable panic, resulting in denial of service. The vulnerable code is registered automatically via init() when the bmp package is imported. Versions of golang.org/x/image prior to v0.40.0 are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42500"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42500",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42500"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42500",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42500"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781500",
          "url": "https://go.dev/cl/781500"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79576",
          "url": "https://go.dev/issue/79576"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI",
          "url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5031",
          "url": "https://pkg.go.dev/vuln/GO-2026-5031"
        }
      ],
      "release_date": "2026-05-29T18:36:28.283000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        },
        {
          "category": "workaround",
          "details": "No mitigation is available for this vulnerability.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/image/bmp: golang: golang.org/x/image/bmp: Denial of Service via out-of-range palette index in BMP decoding"
    },
    {
      "cve": "CVE-2026-42502",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:01:11.151484+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781701",
          "url": "https://go.dev/cl/781701"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79572",
          "url": "https://go.dev/issue/79572"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5027",
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "release_date": "2026-05-22T15:01:21.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
    },
    {
      "cve": "CVE-2026-46598",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-05-22T04:01:24.490498+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480679"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cause the program to panic and crash, resulting in a Denial of Service (DoS) for the affected component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate denial of service flaw exists in the `golang.org/x/crypto/ssh/agent` package. This vulnerability allows an attacker to provide specially crafted inputs that, when processed by the SSH agent, can lead to a program panic and crash. This could result in a temporary disruption of services that rely on the affected SSH agent functionality.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
          "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
          "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480679",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480679"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46598",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781360",
          "url": "https://go.dev/cl/781360"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79596",
          "url": "https://go.dev/issue/79596"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
          "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5033",
          "url": "https://pkg.go.dev/vuln/GO-2026-5033"
        }
      ],
      "release_date": "2026-05-22T02:31:27.986000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-11T02:00:14+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66561"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict the exposure of the SSH agent to untrusted sources. Avoid enabling SSH agent forwarding when connecting to untrusted hosts or environments. Ensure that applications interacting with `golang.org/x/crypto/ssh/agent` validate all inputs to prevent malformed data from being processed. Reloading or restarting SSH services may be required for changes to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@src",
            "Red Hat Hardened Images:golang1.27-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@aarch64",
            "Red Hat Hardened Images:golang1.27-bin-0:1.27.1-0.1.hum1@x86_64",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-docs-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-misc-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-src-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:golang1.27-tests-0:1.27.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.