Linux · Security advisory · July 14, 2026

RHSA-2026:38995: Security update for 9 packages

RHSA-2026:38995, released July 14, 2026, fixes 6 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
6
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0183
79th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 1 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
delveRHEL 80:1.26.1-1.module+el8.10.0+24516+40554724
go-toolsetRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golangRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-binRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-docsRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-miscRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-raceRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-srcRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9
golang-testsRHEL 80:1.26.5-1.module+el8.10.0+24506+6809f2d9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna 10.0 0.0183 None reported
High CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x509 8.2 0.0059 None reported
High CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime 8.8 0.0056 None reported
High CVE-2026-39822 Root escape via symlink plus trailing slash in os 8.2 0.0023 None reported
Routine CVE-2026-42505 Invoking Encrypted Client Hello privacy leak in crypto/tls 5.3 0.0038 None reported
Routine CVE-2026-42507 Arbitrary inputs are included in errors without any escaping in net/textproto 5.3 0.0037 None reported
Showing 1 to 6 of 6 1