- CVE-2026-39821: reject xn-- labels that decode to an all-ASCII label in idna ToASCII/ToUnicode, preventing hostname authorization bypass - CVE-2026-33818: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which enforces a recursion limit in encoding/asn1 Unmarshal - CVE-2026-56858: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which fixes the html/template JavaScript context tracking XSS - CVE-2026-56859: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which adds a recursion depth guard in encoding/xml decoding - CVE-2026-56860: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which avoids quadratic complexity in net/url path resolution - CVE-2026-56862: rebuilt against golang >= 1.22.9-1.tuxcare.els26 which stops counting post-handshake crypto/tls KeyUpdate messages as state-advancing