# RHSA-2026:49702: golang security update

RHSA-2026:49702, released May 27, 2026, fixes 16 CVEs in golang (version 1.26.5-1.el10_0). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2026-49702
- Platform: Linux
- Released: May 27, 2026
- Priority: Urgent (Closes CVE-2026-39821, rated Critical)
- CVEs: 16, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2026:49702

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [golang](https://patchblox.com/security/data/product/linux/golang.md) | RHEL 10 | 1.26.5-1.el10_0 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-39821](https://patchblox.com/security/data/cve/CVE-2026-39821.md) | Urgent | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | 0.0183 |  |
| [CVE-2026-33811](https://patchblox.com/security/data/cve/CVE-2026-33811.md) | High | Crash when handling long CNAME response in net | 8.8 | 0.0088 |  |
| [CVE-2026-33814](https://patchblox.com/security/data/cve/CVE-2026-33814.md) | High | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net | 7.5 | 0.0084 |  |
| [CVE-2026-42499](https://patchblox.com/security/data/cve/CVE-2026-42499.md) | High | Quadratic string concatenation in consumePhrase in net/mail | 8.8 | 0.0080 |  |
| [CVE-2026-39820](https://patchblox.com/security/data/cve/CVE-2026-39820.md) | High | Quadratic string concatentation in consumeComment in net/mail | 8.8 | 0.0078 |  |
| [CVE-2026-27137](https://patchblox.com/security/data/cve/CVE-2026-27137.md) | High | Incorrect enforcement of email constraints in crypto/x509 | 9.1 | 0.0066 |  |
| [CVE-2026-27145](https://patchblox.com/security/data/cve/CVE-2026-27145.md) | High | Inefficient candidate hostname parsing in crypto/x509 | 8.2 | 0.0059 |  |
| [CVE-2026-39825](https://patchblox.com/security/data/cve/CVE-2026-39825.md) | High | ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil | 7.5 | 0.0039 |  |
| [CVE-2026-39826](https://patchblox.com/security/data/cve/CVE-2026-39826.md) | High | Escaper bypass leads to XSS in html/template | 7.5 | 0.0037 |  |
| [CVE-2026-33810](https://patchblox.com/security/data/cve/CVE-2026-33810.md) | High | Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 | 9.1 | 0.0035 |  |
| [CVE-2026-39823](https://patchblox.com/security/data/cve/CVE-2026-39823.md) | High | Bypass of meta content URL escaping causes XSS in html/template | 7.5 | 0.0031 |  |
| [CVE-2026-39822](https://patchblox.com/security/data/cve/CVE-2026-39822.md) | High | Root escape via symlink plus trailing slash in os | 8.2 | 0.0023 |  |
| [CVE-2026-42501](https://patchblox.com/security/data/cve/CVE-2026-42501.md) | High | Malicious module proxy can bypass checksum database in cmd/go | 7.5 | 0.0023 |  |
| [CVE-2026-39819](https://patchblox.com/security/data/cve/CVE-2026-39819.md) | High | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go | 7.5 | 0.0018 |  |
| [CVE-2026-39817](https://patchblox.com/security/data/cve/CVE-2026-39817.md) | High | Invoking "go tool pack" does not sanitize output paths in cmd/go | 7.5 | 0.0017 |  |
| [CVE-2026-42507](https://patchblox.com/security/data/cve/CVE-2026-42507.md) | Routine | Arbitrary inputs are included in errors without any escaping in net/textproto | 5.3 | 0.0037 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo