Linux · Security advisory · April 24, 2026
ELSA-2026-10217: Security update for 8 packages
ELSA-2026-10217, released April 24, 2026, fixes 6 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
6
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0067
52nd percentile
Priority of the 6 CVEs
Patch now 0
Urgent 2
High 4
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| go-toolset | ol 10 | 0:1.25.9-3.el10_1 |
| golang | ol 10 | 0:1.25.9-3.el10_1 |
| golang-bin | ol 10 | 0:1.25.9-3.el10_1 |
| golang-docs | ol 10 | 0:1.25.9-3.el10_1 |
| golang-misc | ol 10 | 0:1.25.9-3.el10_1 |
| golang-race | ol 10 | 0:1.25.9-3.el10_1 |
| golang-src | ol 10 | 0:1.25.9-3.el10_1 |
| golang-tests | ol 10 | 0:1.25.9-3.el10_1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-27140 | Code execution vulnerability in SWIG code generation in cmd/go | 9.8 | 0.0067 | None reported | |
| Urgent | CVE-2026-27143 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile | 9.8 | 0.0055 | None reported | |
| High | CVE-2026-32283 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls | 9.1 | 0.0063 | None reported | |
| High | CVE-2026-32280 | Unexpected work during chain building in crypto/x509 | 9.1 | 0.0063 | None reported | |
| High | CVE-2026-32282 | TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix | 9.1 | 0.0030 | None reported | |
| High | CVE-2026-27144 | Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile | 9.0 | 0.0027 | None reported |
Showing 1 to 6 of 6
1