Detections
Analytics
RHEL 9 : golang (RHSA-2026:57649)
medium Nessus Plugin ID 339516
Synopsis
The remote Red Hat host is missing one or more security updates for golang.Description
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57649 advisory.The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)
* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)
* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)
* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)
* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the RHEL golang package based on the guidance in RHSA-2026:57649.See Also
https://access.redhat.com/errata/RHSA-2026:57649
https://access.redhat.com/security/updates/classification/#important
https://bugzilla.redhat.com/show_bug.cgi?id=2467809
https://bugzilla.redhat.com/show_bug.cgi?id=2467810
https://bugzilla.redhat.com/show_bug.cgi?id=2467811
https://bugzilla.redhat.com/show_bug.cgi?id=2467813
https://bugzilla.redhat.com/show_bug.cgi?id=2467815
https://bugzilla.redhat.com/show_bug.cgi?id=2467820
https://bugzilla.redhat.com/show_bug.cgi?id=2467822
https://bugzilla.redhat.com/show_bug.cgi?id=2467823
https://bugzilla.redhat.com/show_bug.cgi?id=2467825
https://bugzilla.redhat.com/show_bug.cgi?id=2467826
https://bugzilla.redhat.com/show_bug.cgi?id=2480756
https://bugzilla.redhat.com/show_bug.cgi?id=2484205
https://bugzilla.redhat.com/show_bug.cgi?id=2484207
Plugin Details
Severity: Medium
ID: 339516
File Name: redhat-RHSA-2026-57649.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Red Hat Local Security Checks
Published: 8/25/2026
Updated: 8/25/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.89
Vendor
Vendor Severity: Important
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2026-39817
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:redhat:rhel_e4s:9.4, p-cpe:/a:redhat:enterprise_linux:go-toolset, p-cpe:/a:redhat:enterprise_linux:golang-bin, p-cpe:/a:redhat:enterprise_linux:golang-docs, p-cpe:/a:redhat:enterprise_linux:golang-misc, p-cpe:/a:redhat:enterprise_linux:golang-race, p-cpe:/a:redhat:enterprise_linux:golang-src, p-cpe:/a:redhat:enterprise_linux:golang-tests, p-cpe:/a:redhat:enterprise_linux:golang
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 8/20/2026
Vulnerability Publication Date: 5/7/2026
Reference Information
CVE: CVE-2026-27145, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39822, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-42499, CVE-2026-42501, CVE-2026-42507