CLSA-2026-1781256571
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781256571.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1781256571
- Upstream
- Published
- 2026-07-31T12:09:14Z
- Modified
- 2026-10-26T09:43:16Z
- Summary
- golang: Fix of 6 CVEs
- Details
-
- CVE-2026-27142: fix missing escaping of URLs in meta tag content attributes in html/template by tracking the url= portion of the content attribute and applying URL escaping (prerequisite for CVE-2026-39823)
- CVE-2026-39826: fix escaper bypass in html/template by treating script type attributes that are empty or whitespace-only as JavaScript
- CVE-2026-39825: fix query parameter smuggling in net/http/httputil ReverseProxy by reencoding outbound queries that exceed the urlmaxqueryparams limit so Rewrite hooks cannot be bypassed
- CVE-2026-39819: fix 'go bug' writing files with predictable names in the system temporary directory by creating a private directory with os.MkdirTemp, preventing symlink-based file overwrite
- CVE-2026-39817: fix 'go tool pack' extracting archive entries to arbitrary filesystem locations by refusing to extract files with directory components
- CVE-2026-39823: fix XSS in html/template where ASCII whitespace around the '=' rune in a meta tag content attribute URL bypassed URL escaping
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781256571.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-27142
- https://nvd.nist.gov/vuln/detail/CVE-2026-39817
- https://nvd.nist.gov/vuln/detail/CVE-2026-39819
- https://nvd.nist.gov/vuln/detail/CVE-2026-39823
- https://nvd.nist.gov/vuln/detail/CVE-2026-39825
- https://nvd.nist.gov/vuln/detail/CVE-2026-39826