- CVE-2026-33818: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to enforce a maximum recursion depth in encoding/asn1 Unmarshal, preventing stack exhaustion when parsing deeply-nested recursive structures - CVE-2026-39820: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix quadratic complexity in consumeComment in net/mail, preventing CPU exhaustion and excessive memory allocation from well-crafted input to ParseAddress, ParseAddressList and ParseDate - CVE-2026-42499: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix quadratic consumePhrase behaviour in net/mail, preventing denial-of-service when parsing an email address according to RFC 5322 - CVE-2026-56858: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix JavaScript regexp context tracking in html/template so pathological input can no longer close an unescaped '/' early and inject attacker-controlled content - CVE-2026-56859: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to add a recursion depth guard during decode in encoding/xml so DecodeElement no longer resets the depth counter, preventing stack exhaustion - CVE-2026-56860: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to avoid quadratic complexity in net/url resolvePath by resolving '..' segments with index-based backtracking on a byte buffer - CVE-2026-56862: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to stop counting handshake messages as state-advancing after the handshake has completed in crypto/tls, bounding the key derivation work a client can force with repeated KeyUpdate messages