MGASA-2026-0276

Advisory lineage Upstream: 5 Downstream: 0
Published: 20 Jul 2026, 19:06
Last modified:20 Jul 2026, 19:20

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Jul 2026, 19:06
Published
Vulnerability first disclosed
20 Jul 2026, 19:20
Last Modified
Vulnerability information updated

Description

Updated golang packages fix security vulnerabilities The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. (CVE-2026-42504) net/textproto: arbitrary input are included in errors without any escaping. (CVE-2026-42507) crypto/x509: split candidate hostname only once. (CVE-2026-27145) os: Root escape via symlink plus trailing slash. (CVE-2026-39822) crypto/tls: Encrypted Client Hello privacy leak. (CVE-2026-42505)

Affected Systems

  • mageia•golang

    < 1.25.12-1.mga10

  • mageia•golang

    < 1.25.12-1.mga9

References (5)