Linux · Security advisory · November 7, 2026

ALSA-2026:86203: Security update for 9 packages

ALSA-2026:86203, released November 7, 2026, fixes 14 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0063
50th percentile

Priority of the 14 CVEs

Patch now 0 Urgent 0 High 12 Routine 2

Fixed package versions

ProductReleaseFixed in
delvealmalinux 81.26.1-1.module_el8.10.0+4307+6e4cbc60
go-toolsetalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golangalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-binalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-docsalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-miscalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-racealmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-srcalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-testsalmalinux 81.26.10-1.module_el8.10.0+4307+6e4cbc60

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http 7.5 0.0063 None reported
High CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http 9.1 0.0062 None reported
High CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http 7.5 0.0061 None reported
High CVE-2026-97031 Reject malformed ECH outer extension references in crypto/tls 7.5 0.0052 None reported
High CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart 7.5 0.0051 None reported
High CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http 7.5 0.0049 None reported
High CVE-2026-78667 Lack of limit on size of parsed Range headers in net/http 7.5 0.0048 None reported
High CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http 7.5 0.0047 None reported
High CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http 7.5 0.0043 None reported
High CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http 7.5 0.0041 None reported
High CVE-2026-94447 Checksum database bypass for golang.org/toolchain in cmd/go 7.8 0.0010 None reported
High CVE-2026-94444 Checksum bypass for golang.org/fips140 in cmd/go 7.8 0.0010 None reported
Routine CVE-2026-94448 Reset context tracking on consecutive template expressions in html/template 6.1 0.0029 None reported
Routine CVE-2026-97030 Recognize yield as regexp preceder keyword in html/template 6.1 0.0029 None reported
Showing 1 to 14 of 14 1