{"id":"CLSA-2026-1781256571","summary":"golang: Fix of 6 CVEs","details":"- CVE-2026-27142: fix missing escaping of URLs in meta tag content attributes\n  in html/template by tracking the url= portion of the content attribute and\n  applying URL escaping (prerequisite for CVE-2026-39823)\n- CVE-2026-39826: fix escaper bypass in html/template by treating script type\n  attributes that are empty or whitespace-only as JavaScript\n- CVE-2026-39825: fix query parameter smuggling in net/http/httputil\n  ReverseProxy by reencoding outbound queries that exceed the\n  urlmaxqueryparams limit so Rewrite hooks cannot be bypassed\n- CVE-2026-39819: fix 'go bug' writing files with predictable names in the\n  system temporary directory by creating a private directory with\n  os.MkdirTemp, preventing symlink-based file overwrite\n- CVE-2026-39817: fix 'go tool pack' extracting archive entries to arbitrary\n  filesystem locations by refusing to extract files with directory components\n- CVE-2026-39823: fix XSS in html/template where ASCII whitespace around the\n  '=' rune in a meta tag content attribute URL bypassed URL escaping","modified":"2026-10-26T09:43:16.076981870Z","published":"2026-07-31T12:09:14Z","upstream":["CVE-2026-27142","CVE-2026-39817","CVE-2026-39819","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781256571.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39817"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39819"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39823"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826"}],"affected":[{"package":{"name":"go-toolset","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/go-toolset?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-bin","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-bin?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-docs","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-docs?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-misc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-misc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-race","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-race?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-src","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-src?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}},{"package":{"name":"golang-tests","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/golang-tests?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.7-1.el9_6.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json"}}],"schema_version":"1.9.0"}