- rebuild with golang 1.22.9-1.el9_2.tuxcare.els26 to fix five Go standard library CVEs - CVE-2026-33818: encoding/asn1 - enforce a maximum recursion depth when unmarshalling, so deeply nested DER cannot exhaust the stack - CVE-2026-56858: html/template - keep the JavaScript regexp/division context correct across brace transitions, blocking content injection - CVE-2026-56859: encoding/xml - track unmarshal depth on the decoder stack, so DecodeElement can no longer reset the depth limit - CVE-2026-56860: net/url - resolve reference paths with index-based backtracking, removing quadratic time and allocation cost - CVE-2026-56862: crypto/tls - only treat pre-handshake records as state-advancing, so KeyUpdate spam cannot force endless derivation