RHSA-2026%3A19715

RHSA-2026%3A19715 PUBLISHED CVSS 7.5 HIGH

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	git-lfs-debuginfo-0:3.6.1-2.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debugsource-0:3.6.1-2.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
golang	go
Red Hat	git-lfs-0:3.6.1-2.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10

Red Hat	git-lfs-0:3.6.1-2.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Go	go
Red Hat	git-lfs-0:3.6.1-2.el10_0.4.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debuginfo-0:3.6.1-2.el10_0.4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debugsource-0:3.6.1-2.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debuginfo-0:3.6.1-2.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs
Red Hat	git-lfs-debugsource-0:3.6.1-2.el10_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debuginfo-0:3.6.1-2.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-debugsource-0:3.6.1-2.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-0:3.6.1-2.el10_0.4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10
Red Hat	git-lfs-0:3.6.1-2.el10_0.4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)	3.6.1-2.el10, 3.6.1-2.el10, 3.6.1-2.el10

Timeline

May 20, 2026 CVE Published
May 28, 2026 Distribution Patch
Jun 5, 2026 Security Advisory
Jun 12, 2026 Security Advisory
Jun 12, 2026 Security Advisory
Jun 23, 2026 CVE Updated
Jun 23, 2026 Distribution Patch
Jun 23, 2026 Security Advisory

References

https://access.redhat.com/security/updates/classification/#important advisory
https://pkg.go.dev/vuln/GO-2026-4947 advisory
https://go.dev/issue/78293 advisory
https://pkg.go.dev/vuln/GO-2026-4870 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19715.json advisory
https://www.cve.org/CVERecord?id=CVE-2026-32280 advisory
https://pkg.go.dev/vuln/GO-2026-4864 advisory
https://www.cve.org/CVERecord?id=CVE-2026-32283 advisory
https://go.dev/cl/763767 advisory
https://go.dev/issue/78334 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2456338 issue
https://access.redhat.com/security/cve/CVE-2026-32280 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 advisory
https://go.dev/cl/758320 advisory
https://go.dev/cl/763761 advisory
https://go.dev/issue/78282 advisory
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU advisory
https://access.redhat.com/security/cve/CVE-2026-32282 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32282 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32283 advisory

…and 5 more

Open in Interactive Console →