Linux · Security advisory · October 21, 2026

RHSA-2026:86196: Security update for 8 packages

RHSA-2026:86196, released October 21, 2026, fixes 15 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
15
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0063
50th percentile

Priority of the 15 CVEs

Patch now 0 Urgent 0 High 13 Routine 2

Fixed package versions

ProductReleaseFixed in
go-toolsetRHEL 90:1.26.10-1.el9_8
golangRHEL 90:1.26.10-1.el9_8
golang-binRHEL 90:1.26.10-1.el9_8
golang-docsRHEL 90:1.26.10-1.el9_8
golang-miscRHEL 90:1.26.10-1.el9_8
golang-raceRHEL 90:1.26.10-1.el9_8
golang-srcRHEL 90:1.26.10-1.el9_8
golang-testsRHEL 90:1.26.10-1.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http 7.5 0.0063 None reported
High CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http 9.1 0.0062 None reported
High CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http 7.5 0.0061 None reported
High CVE-2026-97031 Reject malformed ECH outer extension references in crypto/tls 7.5 0.0052 None reported
High CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart 7.5 0.0051 None reported
High CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http 7.5 0.0049 None reported
High CVE-2026-78667 Lack of limit on size of parsed Range headers in net/http 7.5 0.0048 None reported
High CVE-2026-56866 HTTP/1 client connection desynchronization after CONNECT rejection in net/http 7.5 0.0047 None reported
High CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http 7.5 0.0043 None reported
High CVE-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http 7.5 0.0041 None reported
High CVE-2026-111943 Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509 8.1 0.0040 None reported
High CVE-2026-94447 Checksum database bypass for golang.org/toolchain in cmd/go 7.8 0.0010 None reported
High CVE-2026-94444 Checksum bypass for golang.org/fips140 in cmd/go 7.8 0.0010 None reported
Routine CVE-2026-94448 Reset context tracking on consecutive template expressions in html/template 6.1 0.0029 None reported
Routine CVE-2026-97030 Recognize yield as regexp preceder keyword in html/template 6.1 0.0029 None reported
Showing 1 to 15 of 15 1