RHSA-2026:80764 - Security Advisory

Topic

An update for goose is now available for Red Hat Enterprise Linux 9.

Description

For details on how to apply this update, which includes the changes
described in this advisory, refer to: https://access.redhat.com/articles/11258

Security Fix(es):

• goose: Arbitrary command execution via malicious Git configuration

in `goose review` (CVE-2026-72718)

• goose: RMCP: Token impersonation via missing OAuth resource field

validation (CVE-2026-63127)

• goose: RMCP: Denial of Service via unauthenticated session table

leak (CVE-2026-63128)

• goose: rustls-webpki: Denial of Service via crafted Certificate

Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact,
a CVSS score, acknowledgments, and other related information, refer
to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• RHEL-254952 - Update goose to 1.45 in RHEL 9.8.z Extensions

CVEs

• CVE-2026-63127
• CVE-2026-63128
• CVE-2026-72718
• CVE-2026-93599

References

• https://access.redhat.com/security/updates/classification/#important