RHSA-2026:54835 | Vulnetix

RHSA-2026:54835 PUBLISHED CVSS 8.100000381469727 HIGH

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

Risk Scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	golang1.26-docs-0:1.26.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images	1.26-docs
Red Hat	golang1.26-tests-0:1.26.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images	1.26-tests
Red Hat	golang1.26-0:1.26.6-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	1.26-0
Red Hat	golang1.26-tests-0:1.26.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images	1.26-tests
Red Hat	golang1.26-0:1.26.6-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	1.26-0
Red Hat	golang1.26-bin-0:1.26.6-0.1.hum1@aarch64 as a component of Red Hat Hardened Images	1.26-bin
Red Hat	golang1.26-docs-0:1.26.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images	1.26-docs
Red Hat	golang1.26-src-0:1.26.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images	1.26-src
Red Hat	golang1-26-main@x86_64 as a component of Red Hat Hardened Images	*
Red Hat	golang1-26-main
Red Hat	golang1.26-0:1.26.6-0.1.hum1@src as a component of Red Hat Hardened Images	1.26-0
Red Hat	golang1-26-main@aarch64 as a component of Red Hat Hardened Images	*
Red Hat	golang1.26-misc-0:1.26.6-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images	1.26-misc
Red Hat	golang1-26-main@src as a component of Red Hat Hardened Images	*
Red Hat	golang1.26-bin-0:1.26.6-0.1.hum1@x86_64 as a component of Red Hat Hardened Images	1.26-bin
Red Hat	golang1.26-misc-0:1.26.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images	1.26-misc
Red Hat	golang1-26-main@noarch as a component of Red Hat Hardened Images	*
Red Hat	golang1.26-src-0:1.26.6-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images	1.26-src

Timeline

Aug 14, 2026 CVE Published
Oct 21, 2026 CVE Updated
Oct 21, 2026 Distribution Patch
Oct 21, 2026 Distribution Patch
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory
Oct 21, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:54835 advisory
https://images.redhat.com/ advisory
https://access.redhat.com/security/cve/CVE-2026-56853 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://access.redhat.com/security/cve/CVE-2026-56860 advisory
https://access.redhat.com/security/cve/CVE-2026-56859 advisory
https://access.redhat.com/security/cve/CVE-2026-33818 advisory
https://access.redhat.com/security/cve/CVE-2026-56862 advisory
https://access.redhat.com/security/cve/CVE-2026-56858 advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54835.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 issue
https://www.cve.org/CVERecord?id=CVE-2026-33818 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 advisory
https://go.dev/cl/814980 advisory
https://go.dev/issue/80405 advisory
https://groups.google.com/g/golang-announce/c/94pEornpRlI advisory
https://pkg.go.dev/vuln/GO-2026-5972 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515827 issue
https://www.cve.org/CVERecord?id=CVE-2026-56853 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56853 advisory

…and 27 more

Open in Interactive Console →