Red Hat Product Errata RHSA-2026:3469 - Security Advisory
Issued:
2026-03-02
Updated:
2026-03-02

RHSA-2026:3469 - Security Advisory

Synopsis

Important: golang security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for golang is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
  • cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x

Fixes

  • BZ - 2434431 - CVE-2025-61728 golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip
  • BZ - 2434432 - CVE-2025-61726 golang: net/url: Memory exhaustion in query parameter parsing in net/url
  • BZ - 2437016 - CVE-2025-61732 cmd/cgo: Potential code smuggling via doc comments in cmd/cgo

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
x86_64
go-toolset-1.21.13-14.el9_4.x86_64.rpm SHA-256: 8b096b4ba04eb21bb133f8102389e73f8167c5841d12a025cf0c7a4668c99a82
golang-1.21.13-14.el9_4.x86_64.rpm SHA-256: f72dbf50971db487c8304fc750fe530a170442ec90dded891f9c70cf4ac02804
golang-bin-1.21.13-14.el9_4.x86_64.rpm SHA-256: 18cbb5f8bf5eb6e5230cbe0798870663a5dc092a1b34ab2cf1e901db17cd7a0a
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
x86_64
go-toolset-1.21.13-14.el9_4.x86_64.rpm SHA-256: 8b096b4ba04eb21bb133f8102389e73f8167c5841d12a025cf0c7a4668c99a82
golang-1.21.13-14.el9_4.x86_64.rpm SHA-256: f72dbf50971db487c8304fc750fe530a170442ec90dded891f9c70cf4ac02804
golang-bin-1.21.13-14.el9_4.x86_64.rpm SHA-256: 18cbb5f8bf5eb6e5230cbe0798870663a5dc092a1b34ab2cf1e901db17cd7a0a
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
s390x
go-toolset-1.21.13-14.el9_4.s390x.rpm SHA-256: 03d3eafbab040201f91b8be011589a9dd520aeeb070205612ae4c6a3ca276b42
golang-1.21.13-14.el9_4.s390x.rpm SHA-256: 5c075f34f7dd49423369b1d0e3cc7a5c0da4a5f6de434792e78e65c4380b8eb6
golang-bin-1.21.13-14.el9_4.s390x.rpm SHA-256: 723be61cdeeedfd3fed05130e9ee8b44450fad7b1cc1696316b2d44414473d86
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
ppc64le
go-toolset-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 27537cfa6c3d7732e61232b52260ad680337cdae350b92766e1a5b1aba48e357
golang-1.21.13-14.el9_4.ppc64le.rpm SHA-256: e543951de1980a748f7779ea3204e7781c3ae9b09e5ccab0a983982d6829c513
golang-bin-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 9e0222060966e891ae746e8cced92aa279801c1680e03e5230959e453b440737
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
aarch64
go-toolset-1.21.13-14.el9_4.aarch64.rpm SHA-256: add24a9c1d1a72ea238cec7474ed6ec5f2ca21dddd86529782bc6d9c330db16d
golang-1.21.13-14.el9_4.aarch64.rpm SHA-256: eb747a7fc6d442e7a59361abadfc0e1b4c76a69398125c8fb74cf07f7dc011c8
golang-bin-1.21.13-14.el9_4.aarch64.rpm SHA-256: c7615c294e6b19fe8622985d29a5f7a31820ba4a351dd70d8a620674b7be6ced
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
ppc64le
go-toolset-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 27537cfa6c3d7732e61232b52260ad680337cdae350b92766e1a5b1aba48e357
golang-1.21.13-14.el9_4.ppc64le.rpm SHA-256: e543951de1980a748f7779ea3204e7781c3ae9b09e5ccab0a983982d6829c513
golang-bin-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 9e0222060966e891ae746e8cced92aa279801c1680e03e5230959e453b440737
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
x86_64
go-toolset-1.21.13-14.el9_4.x86_64.rpm SHA-256: 8b096b4ba04eb21bb133f8102389e73f8167c5841d12a025cf0c7a4668c99a82
golang-1.21.13-14.el9_4.x86_64.rpm SHA-256: f72dbf50971db487c8304fc750fe530a170442ec90dded891f9c70cf4ac02804
golang-bin-1.21.13-14.el9_4.x86_64.rpm SHA-256: 18cbb5f8bf5eb6e5230cbe0798870663a5dc092a1b34ab2cf1e901db17cd7a0a
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
aarch64
go-toolset-1.21.13-14.el9_4.aarch64.rpm SHA-256: add24a9c1d1a72ea238cec7474ed6ec5f2ca21dddd86529782bc6d9c330db16d
golang-1.21.13-14.el9_4.aarch64.rpm SHA-256: eb747a7fc6d442e7a59361abadfc0e1b4c76a69398125c8fb74cf07f7dc011c8
golang-bin-1.21.13-14.el9_4.aarch64.rpm SHA-256: c7615c294e6b19fe8622985d29a5f7a31820ba4a351dd70d8a620674b7be6ced
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
s390x
go-toolset-1.21.13-14.el9_4.s390x.rpm SHA-256: 03d3eafbab040201f91b8be011589a9dd520aeeb070205612ae4c6a3ca276b42
golang-1.21.13-14.el9_4.s390x.rpm SHA-256: 5c075f34f7dd49423369b1d0e3cc7a5c0da4a5f6de434792e78e65c4380b8eb6
golang-bin-1.21.13-14.el9_4.s390x.rpm SHA-256: 723be61cdeeedfd3fed05130e9ee8b44450fad7b1cc1696316b2d44414473d86
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
x86_64
go-toolset-1.21.13-14.el9_4.x86_64.rpm SHA-256: 8b096b4ba04eb21bb133f8102389e73f8167c5841d12a025cf0c7a4668c99a82
golang-1.21.13-14.el9_4.x86_64.rpm SHA-256: f72dbf50971db487c8304fc750fe530a170442ec90dded891f9c70cf4ac02804
golang-bin-1.21.13-14.el9_4.x86_64.rpm SHA-256: 18cbb5f8bf5eb6e5230cbe0798870663a5dc092a1b34ab2cf1e901db17cd7a0a
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
aarch64
go-toolset-1.21.13-14.el9_4.aarch64.rpm SHA-256: add24a9c1d1a72ea238cec7474ed6ec5f2ca21dddd86529782bc6d9c330db16d
golang-1.21.13-14.el9_4.aarch64.rpm SHA-256: eb747a7fc6d442e7a59361abadfc0e1b4c76a69398125c8fb74cf07f7dc011c8
golang-bin-1.21.13-14.el9_4.aarch64.rpm SHA-256: c7615c294e6b19fe8622985d29a5f7a31820ba4a351dd70d8a620674b7be6ced
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
ppc64le
go-toolset-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 27537cfa6c3d7732e61232b52260ad680337cdae350b92766e1a5b1aba48e357
golang-1.21.13-14.el9_4.ppc64le.rpm SHA-256: e543951de1980a748f7779ea3204e7781c3ae9b09e5ccab0a983982d6829c513
golang-bin-1.21.13-14.el9_4.ppc64le.rpm SHA-256: 9e0222060966e891ae746e8cced92aa279801c1680e03e5230959e453b440737
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4

SRPM
golang-1.21.13-14.el9_4.src.rpm SHA-256: d3d6f94b290f4122465c1f87482a9fedd074f8a32a89fcdac17cf932e89e7ec6
s390x
go-toolset-1.21.13-14.el9_4.s390x.rpm SHA-256: 03d3eafbab040201f91b8be011589a9dd520aeeb070205612ae4c6a3ca276b42
golang-1.21.13-14.el9_4.s390x.rpm SHA-256: 5c075f34f7dd49423369b1d0e3cc7a5c0da4a5f6de434792e78e65c4380b8eb6
golang-bin-1.21.13-14.el9_4.s390x.rpm SHA-256: 723be61cdeeedfd3fed05130e9ee8b44450fad7b1cc1696316b2d44414473d86
golang-docs-1.21.13-14.el9_4.noarch.rpm SHA-256: e5dcca43ab723a639a28de4fa33df32e9ec9d919b83f92838a9a70f8c321a1bc
golang-misc-1.21.13-14.el9_4.noarch.rpm SHA-256: a915dbc9123e822a98b5b9eec3ec92b3d0af235297dcb643f71498ac689774a4
golang-src-1.21.13-14.el9_4.noarch.rpm SHA-256: 02357b2d0e8daf1c5a9f2e178d8bf5a22d2ea239425d080595493d23adfe77af
golang-tests-1.21.13-14.el9_4.noarch.rpm SHA-256: 32c875d32526a237045027ca5499c566ae100731782d686c4898eda3b6c8b1c6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.