[CLSA-2026:1789647110] golang: Fix of CVE-2026-42504
Type:
security
Severity:
Important
Release date:
2026-09-17 12:12:00 UTC
Description:
- CVE-2026-42504: mime - skip over the entire undecodable encoded-word instead of only the initial "=?" in WordDecoder.DecodeHeader, avoiding quadratic complexity and CPU exhaustion when decoding a header with many invalid encoded-words
CVEs fixed:
Updated packages:
  • go-toolset-1.22.9-1.el9_2.tuxcare.els28.x86_64.rpm
    sha:9c24b331bd0ec5d7c9cfb184b087848a9afb8cf9578138ca484357cb4618b789
  • golang-1.22.9-1.el9_2.tuxcare.els28.x86_64.rpm
    sha:61e987ac0f96021f6cbf69dbee937fc26e078a2257678c84128b1ce2a7621c44
  • golang-bin-1.22.9-1.el9_2.tuxcare.els28.x86_64.rpm
    sha:684079bf6b0646cc56871f125572ee7dd2910f411e940cb45c6e36207f436222
  • golang-docs-1.22.9-1.el9_2.tuxcare.els28.noarch.rpm
    sha:96326bcdba55f1700ad14d7cda6edbb04ab3c85b694c8c2784b62bea59641b5b
  • golang-misc-1.22.9-1.el9_2.tuxcare.els28.noarch.rpm
    sha:494ff8ecce5d43260c3bb5911787446cbcb07bae35fcc5e59e53dd5cb75739ca
  • golang-src-1.22.9-1.el9_2.tuxcare.els28.noarch.rpm
    sha:f616d6186b19500574e04ac37e32ffb8ec6c7b6a1ac343582e3cfb428e9352a7
  • golang-tests-1.22.9-1.el9_2.tuxcare.els28.noarch.rpm
    sha:1ab9e125fa3586f1563745a2bc665ce3443d2c9e17e9a42e2c3fd8239f8cc96e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.