Critical Security Update for Go Packages: Addressing Email Constraints and IPv6 Parsing Vulnerabilities
Summary
ALSA-2026:19181: Important: golang security update. Affects go-toolset versions < 1.26.2-1.el9_8. Fixed in 1.26.2-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language, commonly referred to as Golang, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software applications. The affected packages include go-toolset, golang, golang-bin, golang-docs, golang-misc, golang-race, golang-src, and golang-tests, all of which are essential for Go development and deployment. These packages provide the necessary tools and libraries for developers to create and manage Go applications effectively.
Vulnerability Detail
The vulnerabilities stem from two critical issues: first, an incorrect enforcement of email constraints in the crypto/x509 package (CVE-2026-27137), which could lead to improper validation of email addresses, potentially allowing malicious actors to exploit this flaw. Second, the net/url package has an incorrect parsing of IPv6 host literals (CVE-2026-25679), which could result in improper handling of network requests, leading to security breaches. Both vulnerabilities could have severe ramifications, including unauthorized access and data leaks.
How To Fix
Minimum fixed version
1.26.2-1.el9_8
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using the affected functionalities related to email validation and IPv6 parsing until the packages are updated. However, it is highly recommended to apply the patch as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
In summary, the Go packages have critical vulnerabilities that need immediate attention. Updating to the patched version is crucial to maintaining the security of applications built with these packages. Utilizing tools like Vulert can further enhance your security posture by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for go-toolset →
FAQ
The vulnerabilities include incorrect enforcement of email constraints and improper parsing of IPv6 host literals, which can lead to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using the affected functionalities and monitor for any suspicious activity in your applications.
More details can be found on the CVE pages for CVE-2026-25679 and CVE-2026-27137, which provide in-depth information about the vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It helps ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
