Critical Security Vulnerability in Go Toolset: Red Hat Advisory RHSA-2026:62602
Summary
RHSA-2026:62602: Red Hat Security Advisory: golang security update. Affects go-toolset versions < 0:1.26.7-1.el9_2. Fixed in 0:1.26.7-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, widely used for building scalable and high-performance applications. It includes essential components such as the Go compiler, standard libraries, and additional tools for development. This advisory addresses multiple vulnerabilities affecting various packages within the Go ecosystem, specifically targeting Red Hat Enterprise Linux 9.2.
Vulnerability Detail
This vulnerability, identified in multiple packages including go-toolset and golang, stems from flaws in the Go programming language's handling of certain operations. The vulnerabilities could allow attackers to exploit the affected systems, potentially leading to unauthorized access, data breaches, or denial of service. The vulnerabilities are tracked under several CVEs, including CVE-2026-33818 and CVE-2026-56860, with a CVSS score of 8.1 indicating a high severity level.
How To Fix
Minimum fixed version
0:1.26.7-1.el9_2
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the exposure of affected applications and services until the packages can be updated. This may include restricting network access or disabling certain features that rely on the vulnerable components.
Conclusion
In summary, the Red Hat Security Advisory RHSA-2026:62602 highlights critical vulnerabilities in the Go Toolset and related packages. Users are urged to update to the patched version to mitigate risks associated with these vulnerabilities. Temporary workarounds can be implemented while updates are being applied.
See every vulnerability recorded for go-toolset →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
The affected packages include go-toolset, golang, golang-bin, golang-docs, golang-misc, golang-race, golang-src, and golang-tests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing network restrictions or disabling features that utilize the vulnerable components as a temporary workaround.
More information can be found in the Red Hat Security Advisory RHSA-2026:62602 and the associated CVEs.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
