Most recent entries from all

ALSA-2026:37435 — Important: golang security, bug fix, and enhancement update

Affected: AlmaLinux:9: go-toolset, AlmaLinux:9: golang, AlmaLinux:9: golang-bin, AlmaLinux:9: golang-docs, AlmaLinux:9: golang-misc, AlmaLinux:9: golang-race, AlmaLinux:9: golang-src, AlmaLinux:9: golang-tests

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.5+1 [almalinux-9.8.z] (JIRA:AlmaLinux-193476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-15294

BELL-CVE-2026-39822

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

BIT-golang-2026-39822 — Root escape via symlink plus trailing slash in os

Affected: Bitnami: golang

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

certfr-2026-avi-1089 — De multiples vulnérabilités ont été découvertes dans Tenable Enclave Security. Elles permettent à un attaquant de provo…

certfr-2026-avi-1089

Withdrawn: CLEANSTART-2026-AC51978 — Security fixes for CVE-2026-39822, CVE-2026-42504, CVE-2026-42505 applied in versions: 0.15.4-r3, 0.15.4-r4

Withdrawn by the publisher.

Affected: CleanStart: haproxy-ingress

Multiple security vulnerabilities affect the haproxy-ingress package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-334043

fkie_cve-2026-39822

GHSA-xcgv-8mv7-v8c7

msrc_CVE-2026-39822 — Root escape via symlink plus trailing slash in os

msrc_CVE-2026-39822

NCSC-2026-0375 — Kwetsbaarheden verholpen in Oracle Communications

NCSC-2026-0375

openSUSE-SU-2026:11212-1 — go1.25-1.25.12-1.1 on GA media

go1.25-1.25.12-1.1 on GA media

RHSA-2026:36477 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

golang: Go os.Root: Symlink following vulnerability allows directory traversal crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello

RLSA-2026:37435 — Important: golang security, bug fix, and enhancement update

Affected: Rocky Linux:9: golang

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.5+1 [rhel-9.8.z] (JIRA:Rocky Linux-193476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22638-1 — Security update for go1.25-openssl

Security update for go1.25-openssl

UBUNTU-CVE-2026-39822

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more

VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

WID-SEC-W-2026-2239 — Golang Go: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Informationen offenzulegen.