MGASA-2026-0276

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0276.html
Import Source
https://advisories.mageia.org/MGASA-2026-0276.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0276
Upstream
  • CVE-2026-27145
  • CVE-2026-42504
  • CVE-2026-42507
Published
2026-07-20T19:06:32Z
Modified
2026-07-20T19:20:54Z
Summary
Updated golang packages fix security vulnerabilities
Details

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. (CVE-2026-42504) net/textproto: arbitrary input are included in errors without any escaping. (CVE-2026-42507) crypto/x509: split candidate hostname only once. (CVE-2026-27145) os: Root escape via symlink plus trailing slash. (CVE-2026-39822) crypto/tls: Encrypted Client Hello privacy leak. (CVE-2026-42505)

References
Credits

Affected packages

Mageia:10 / golang

Package

Name
golang
Purl
pkg:rpm/mageia/golang?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.12-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0276.json"

Mageia:9 / golang

Package

Name
golang
Purl
pkg:rpm/mageia/golang?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.12-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0276.json"