Linux · Security advisory · April 27, 2026

ELSA-2026-10704: Security update for 9 packages

ELSA-2026-10704, released April 27, 2026, fixes 6 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
6
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0067
52nd percentile

Priority of the 6 CVEs

Patch now 0 Urgent 2 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
delveol 80:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd
go-toolsetol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golangol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-binol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-docsol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-miscol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-raceol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-srcol 80:1.25.9-1.module+el8.10.0+90881+305b00ae
golang-testsol 80:1.25.9-1.module+el8.10.0+90881+305b00ae

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-27140 Code execution vulnerability in SWIG code generation in cmd/go 9.8 0.0067 None reported
Urgent CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile 9.8 0.0055 None reported
High CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls 9.1 0.0063 None reported
High CVE-2026-32280 Unexpected work during chain building in crypto/x509 9.1 0.0063 None reported
High CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix 9.1 0.0030 None reported
High CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile 9.0 0.0027 None reported
Showing 1 to 6 of 6 1