Red Hat Product Errata RHSA-2026:2706 - Security Advisory
Issued:
2026-02-16
Updated:
2026-02-16

RHSA-2026:2706 - Security Advisory

Synopsis

Important: golang security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for golang is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
  • cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)
  • crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

  • BZ - 2434431 - CVE-2025-61728 golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip
  • BZ - 2434432 - CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url
  • BZ - 2437016 - CVE-2025-61732 cmd/cgo: Potential code smuggling via doc comments in cmd/cgo
  • BZ - 2437111 - CVE-2025-68121 crypto/tls: Unexpected session resumption in crypto/tls

Red Hat Enterprise Linux for x86_64 10

SRPM
golang-1.25.7-1.el10_1.src.rpm SHA-256: 529f0fe4a873eedf66186c02e3a2660e78f8ebe649691649c238b71d1b92852e
x86_64
go-toolset-1.25.7-1.el10_1.x86_64.rpm SHA-256: ecbb77545686df93974aee3381874b718b4633b59e0b0ff18da9ea9a60a1ad71
golang-1.25.7-1.el10_1.x86_64.rpm SHA-256: 23f233e97522bd3e25feaf2ab8b56b50df6818831f7c2c58887299f45213f6ab
golang-bin-1.25.7-1.el10_1.x86_64.rpm SHA-256: 8ddd0d033246d0aa5ba367959342f038f3301754ce9c95e8454c70bdf4b19ae4
golang-docs-1.25.7-1.el10_1.noarch.rpm SHA-256: 2c38fd8c3a9addaea8535ab6568dc5f71eb84e3f614e6d0baa8727036a8d2e8f
golang-misc-1.25.7-1.el10_1.noarch.rpm SHA-256: 428fc1f9918f036cd25492bdd0c2b1924bf7a46ae4e068f20b21698717b22fb3
golang-race-1.25.7-1.el10_1.x86_64.rpm SHA-256: c7eae597f6d8535b02b6022da9dab7a6e1fdc9f4ecea37c4518762c792d1992f
golang-src-1.25.7-1.el10_1.noarch.rpm SHA-256: 6e9b0d4c7362e894863ffd22fd56d55826022d3d4adc2bd19e34dec608a61f2a
golang-tests-1.25.7-1.el10_1.noarch.rpm SHA-256: 2b4a9d7bb1ed1263a85d3f393e84511f9269f810582cedd540a32896c7998f76

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
golang-1.25.7-1.el10_1.src.rpm SHA-256: 529f0fe4a873eedf66186c02e3a2660e78f8ebe649691649c238b71d1b92852e
s390x
go-toolset-1.25.7-1.el10_1.s390x.rpm SHA-256: 53c8f7306f0762fc1df707b56cf5ded5650c76a0443e77bf7f02df9e5bae4f1e
golang-1.25.7-1.el10_1.s390x.rpm SHA-256: 82472662107d26e21f7a97e3e9b64d3dd4f6e5bc524de5f13019bcdcf83fb891
golang-bin-1.25.7-1.el10_1.s390x.rpm SHA-256: da7c560da59c821ce0e93f0de03d008f1a6937e7b801c612f4217ceb68d3d616
golang-docs-1.25.7-1.el10_1.noarch.rpm SHA-256: 2c38fd8c3a9addaea8535ab6568dc5f71eb84e3f614e6d0baa8727036a8d2e8f
golang-misc-1.25.7-1.el10_1.noarch.rpm SHA-256: 428fc1f9918f036cd25492bdd0c2b1924bf7a46ae4e068f20b21698717b22fb3
golang-race-1.25.7-1.el10_1.s390x.rpm SHA-256: 3c0388bedaca093e9006520d76fc9cfce8f63dd54a41ac4ba4f2bac121cf4247
golang-src-1.25.7-1.el10_1.noarch.rpm SHA-256: 6e9b0d4c7362e894863ffd22fd56d55826022d3d4adc2bd19e34dec608a61f2a
golang-tests-1.25.7-1.el10_1.noarch.rpm SHA-256: 2b4a9d7bb1ed1263a85d3f393e84511f9269f810582cedd540a32896c7998f76

Red Hat Enterprise Linux for Power, little endian 10

SRPM
golang-1.25.7-1.el10_1.src.rpm SHA-256: 529f0fe4a873eedf66186c02e3a2660e78f8ebe649691649c238b71d1b92852e
ppc64le
go-toolset-1.25.7-1.el10_1.ppc64le.rpm SHA-256: d0647f96290660f3597e46608d2d03473a42b9113755ec14247037416c8760ea
golang-1.25.7-1.el10_1.ppc64le.rpm SHA-256: 87fc8127696007ecd1099e25a90c1dc67649981ec97335591aaab3ed41ca6d46
golang-bin-1.25.7-1.el10_1.ppc64le.rpm SHA-256: a33be98b8ddc1e46c787b8f951d7422704b557f5dbceb26e58f1b7d7ac7505eb
golang-docs-1.25.7-1.el10_1.noarch.rpm SHA-256: 2c38fd8c3a9addaea8535ab6568dc5f71eb84e3f614e6d0baa8727036a8d2e8f
golang-misc-1.25.7-1.el10_1.noarch.rpm SHA-256: 428fc1f9918f036cd25492bdd0c2b1924bf7a46ae4e068f20b21698717b22fb3
golang-race-1.25.7-1.el10_1.ppc64le.rpm SHA-256: aabed8868a3c97ab0274b2b6df6ef75da2abfe8ee81f29bc47aa82b78c73a51f
golang-src-1.25.7-1.el10_1.noarch.rpm SHA-256: 6e9b0d4c7362e894863ffd22fd56d55826022d3d4adc2bd19e34dec608a61f2a
golang-tests-1.25.7-1.el10_1.noarch.rpm SHA-256: 2b4a9d7bb1ed1263a85d3f393e84511f9269f810582cedd540a32896c7998f76

Red Hat Enterprise Linux for ARM 64 10

SRPM
golang-1.25.7-1.el10_1.src.rpm SHA-256: 529f0fe4a873eedf66186c02e3a2660e78f8ebe649691649c238b71d1b92852e
aarch64
go-toolset-1.25.7-1.el10_1.aarch64.rpm SHA-256: 21b9cdc19062f7d7402fdabde292c5c02b19f9ea8ffed5cbda0b72f9e289fbe8
golang-1.25.7-1.el10_1.aarch64.rpm SHA-256: 078ad2d2a483ab63decde074d34d8736d4e3ce9bc4bebe49c551340db6daa95d
golang-bin-1.25.7-1.el10_1.aarch64.rpm SHA-256: 39699c46efa83d043ec2751a4991714b1c639f2d38595a52715ed067cc9d5179
golang-docs-1.25.7-1.el10_1.noarch.rpm SHA-256: 2c38fd8c3a9addaea8535ab6568dc5f71eb84e3f614e6d0baa8727036a8d2e8f
golang-misc-1.25.7-1.el10_1.noarch.rpm SHA-256: 428fc1f9918f036cd25492bdd0c2b1924bf7a46ae4e068f20b21698717b22fb3
golang-race-1.25.7-1.el10_1.aarch64.rpm SHA-256: cd72e8c258832440ebbc5dc58e45a16cc5e4512fe91093f76d7b614fd93a7ad3
golang-src-1.25.7-1.el10_1.noarch.rpm SHA-256: 6e9b0d4c7362e894863ffd22fd56d55826022d3d4adc2bd19e34dec608a61f2a
golang-tests-1.25.7-1.el10_1.noarch.rpm SHA-256: 2b4a9d7bb1ed1263a85d3f393e84511f9269f810582cedd540a32896c7998f76

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.