# ALSA-2026:22112: Security update for 9 packages

ALSA-2026:22112, released June 1, 2026, fixes 13 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-22112
- Platform: Linux
- Released: Jun 1, 2026
- Priority: High (Closes CVE-2026-33811, high severity)
- CVEs: 13, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:22112

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [delve](https://patchblox.com/security/data/product/linux/delve.md) | almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 |
| [go-toolset](https://patchblox.com/security/data/product/linux/go-toolset.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang](https://patchblox.com/security/data/product/linux/golang.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-bin](https://patchblox.com/security/data/product/linux/golang-bin.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-docs](https://patchblox.com/security/data/product/linux/golang-docs.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-misc](https://patchblox.com/security/data/product/linux/golang-misc.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-race](https://patchblox.com/security/data/product/linux/golang-race.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-src](https://patchblox.com/security/data/product/linux/golang-src.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |
| [golang-tests](https://patchblox.com/security/data/product/linux/golang-tests.md) | almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-33811](https://patchblox.com/security/data/cve/CVE-2026-33811.md) | High | Crash when handling long CNAME response in net | 8.8 | 0.0088 |  |
| [CVE-2026-33814](https://patchblox.com/security/data/cve/CVE-2026-33814.md) | High | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net | 7.5 | 0.0084 |  |
| [CVE-2026-42499](https://patchblox.com/security/data/cve/CVE-2026-42499.md) | High | Quadratic string concatenation in consumePhrase in net/mail | 8.8 | 0.0080 |  |
| [CVE-2026-39820](https://patchblox.com/security/data/cve/CVE-2026-39820.md) | High | Quadratic string concatentation in consumeComment in net/mail | 8.8 | 0.0078 |  |
| [CVE-2026-39836](https://patchblox.com/security/data/cve/CVE-2026-39836.md) | High | Panic in Dial and LookupPort when handling NUL byte on Windows in net | 7.5 | 0.0063 |  |
| [CVE-2026-39825](https://patchblox.com/security/data/cve/CVE-2026-39825.md) | High | ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil | 7.5 | 0.0039 |  |
| [CVE-2026-39826](https://patchblox.com/security/data/cve/CVE-2026-39826.md) | High | Escaper bypass leads to XSS in html/template | 7.5 | 0.0037 |  |
| [CVE-2026-39823](https://patchblox.com/security/data/cve/CVE-2026-39823.md) | High | Bypass of meta content URL escaping causes XSS in html/template | 7.5 | 0.0031 |  |
| [CVE-2026-42501](https://patchblox.com/security/data/cve/CVE-2026-42501.md) | High | Malicious module proxy can bypass checksum database in cmd/go | 7.5 | 0.0023 |  |
| [CVE-2026-39819](https://patchblox.com/security/data/cve/CVE-2026-39819.md) | High | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go | 7.5 | 0.0018 |  |
| [CVE-2026-39817](https://patchblox.com/security/data/cve/CVE-2026-39817.md) | High | Invoking "go tool pack" does not sanitize output paths in cmd/go | 7.5 | 0.0017 |  |
| [CVE-2026-32289](https://patchblox.com/security/data/cve/CVE-2026-32289.md) | Routine | JsBraceDepth Context Tracking Bugs (XSS) in html/template | 6.1 | 0.0030 |  |
| [CVE-2026-32288](https://patchblox.com/security/data/cve/CVE-2026-32288.md) | Routine | Unbounded allocation for old GNU sparse in archive/tar | 5.5 | 0.0030 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo