# ALSA-2026:86196: Security update for 8 packages

ALSA-2026:86196, released November 7, 2026, fixes 15 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-86196
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-78659, high severity)
- CVEs: 15, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:86196

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [go-toolset](https://patchblox.com/security/data/product/linux/go-toolset.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang](https://patchblox.com/security/data/product/linux/golang.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-bin](https://patchblox.com/security/data/product/linux/golang-bin.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-docs](https://patchblox.com/security/data/product/linux/golang-docs.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-misc](https://patchblox.com/security/data/product/linux/golang-misc.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-race](https://patchblox.com/security/data/product/linux/golang-race.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-src](https://patchblox.com/security/data/product/linux/golang-src.md) | almalinux 9 | 1.26.10-1.el9_8 |
| [golang-tests](https://patchblox.com/security/data/product/linux/golang-tests.md) | almalinux 9 | 1.26.10-1.el9_8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-78659](https://patchblox.com/security/data/cve/CVE-2026-78659.md) | High | HTTP/2 server memory exhaustion due to Trailer headers in net/http | 7.5 | 0.0063 |  |
| [CVE-2026-78663](https://patchblox.com/security/data/cve/CVE-2026-78663.md) | High | Double flow control refund on HTTP/2 server streams in net/http | 9.1 | 0.0062 |  |
| [CVE-2026-78669](https://patchblox.com/security/data/cve/CVE-2026-78669.md) | High | Excessive CPU consumption from repeated initial window changes in net/http | 7.5 | 0.0061 |  |
| [CVE-2026-97031](https://patchblox.com/security/data/cve/CVE-2026-97031.md) | High | Reject malformed ECH outer extension references in crypto/tls | 7.5 | 0.0052 |  |
| [CVE-2026-94440](https://patchblox.com/security/data/cve/CVE-2026-94440.md) | High | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | 7.5 | 0.0051 |  |
| [CVE-2026-97032](https://patchblox.com/security/data/cve/CVE-2026-97032.md) | High | HTTP/2 server crash due to HPACK encoder race in net/http | 7.5 | 0.0049 |  |
| [CVE-2026-78667](https://patchblox.com/security/data/cve/CVE-2026-78667.md) | High | Lack of limit on size of parsed Range headers in net/http | 7.5 | 0.0048 |  |
| [CVE-2026-56866](https://patchblox.com/security/data/cve/CVE-2026-56866.md) | High | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | 7.5 | 0.0047 |  |
| [CVE-2026-78660](https://patchblox.com/security/data/cve/CVE-2026-78660.md) | High | HTTP/2 transport accepts malformed framing-related headers in net/http | 7.5 | 0.0043 |  |
| [CVE-2026-94439](https://patchblox.com/security/data/cve/CVE-2026-94439.md) | High | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | 7.5 | 0.0041 |  |
| [CVE-2026-111943](https://patchblox.com/security/data/cve/CVE-2026-111943.md) | High | Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509 | 8.1 | 0.0040 |  |
| [CVE-2026-94447](https://patchblox.com/security/data/cve/CVE-2026-94447.md) | High | Checksum database bypass for golang.org/toolchain in cmd/go | 7.8 | 0.0010 |  |
| [CVE-2026-94444](https://patchblox.com/security/data/cve/CVE-2026-94444.md) | High | Checksum bypass for golang.org/fips140 in cmd/go | 7.8 | 0.0010 |  |
| [CVE-2026-94448](https://patchblox.com/security/data/cve/CVE-2026-94448.md) | Routine | Reset context tracking on consecutive template expressions in html/template | 6.1 | 0.0029 |  |
| [CVE-2026-97030](https://patchblox.com/security/data/cve/CVE-2026-97030.md) | Routine | Recognize yield as regexp preceder keyword in html/template | 6.1 | 0.0029 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo