Linux · Security advisory · July 18, 2026

RHSA-2026:39879: Security update for 2 packages

RHSA-2026:39879, released July 18, 2026, fixes 2 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
2
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0183
79th percentile

Priority of the 2 CVEs

Patch now 0 Urgent 1 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
rhcRHEL 91:0.2.7-8.el9_8
rhc-develRHEL 91:0.2.7-8.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna 10.0 0.0183 None reported
High CVE-2026-27145 Inefficient candidate hostname parsing in crypto/x509 8.2 0.0059 None reported
Showing 1 to 2 of 2 1