- CVE-2026-39820: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix quadratic complexity in consumeComment in net/mail, where repeated string concatenation made nested comment depth O(n^2) - CVE-2026-42499: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix quadratic consumePhrase behavior in net/mail, which repeatedly concatenated encoded-word runs into the previous slice element - CVE-2026-33818: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix stack exhaustion in encoding/asn1 Unmarshal when parsing deeply-nested recursive structures - CVE-2026-56853: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to apply ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface read, and clear the connection timeouts once the connection is handed off to http2 - CVE-2026-56858: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix JavaScript regexp context tracking in html/template, where pathological input could close an unescaped '/' early and inject attacker-controlled content - CVE-2026-56859: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix stack exhaustion in encoding/xml, where DecodeElement reset the recursion depth counter - CVE-2026-56860: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix quadratic complexity in net/url resolvePath when resolving '..' segments - CVE-2026-56862: rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to fix unbounded key derivation work in crypto/tls, where handshake messages still counted as state-advancing after the handshake completed