{"schema":"vulnpedia.research/1","cve":"CVE-2026-94447","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://go.dev/cl/840785","tags":["FIX","vendor-reference"],"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","origins":[{"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","url":"https://go.dev/cl/840785"},{"source":"nvd","sourceId":"CVE-2026-94447","modified":"2026-10-15T16:18:24.170","url":"https://go.dev/cl/840785"},{"source":"go","sourceId":"GO-2026-6602","url":"https://go.dev/cl/840785"},{"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","url":"https://go.dev/cl/840785"},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://go.dev/cl/840785"}]},{"url":"https://go.dev/issue/81834","tags":["REPORT","vendor-reference"],"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","origins":[{"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","url":"https://go.dev/issue/81834"},{"source":"nvd","sourceId":"CVE-2026-94447","modified":"2026-10-15T16:18:24.170","url":"https://go.dev/issue/81834"},{"source":"go","sourceId":"GO-2026-6602","url":"https://go.dev/issue/81834"},{"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","url":"https://go.dev/issue/81834"},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://go.dev/issue/81834"}]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":["WEB","vendor-reference"],"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","origins":[{"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"},{"source":"nvd","sourceId":"CVE-2026-94447","modified":"2026-10-15T16:18:24.170","url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"},{"source":"go","sourceId":"GO-2026-6602","url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"},{"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"}]},{"url":"https://pkg.go.dev/vuln/GO-2026-6602","tags":["vendor-reference"],"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","origins":[{"source":"mitre","sourceId":"Go","modified":"2026-10-08T22:53:57.974Z","url":"https://pkg.go.dev/vuln/GO-2026-6602"},{"source":"nvd","sourceId":"CVE-2026-94447","modified":"2026-10-15T16:18:24.170","url":"https://pkg.go.dev/vuln/GO-2026-6602"},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://pkg.go.dev/vuln/GO-2026-6602"}]},{"url":"https://osv.dev/vulnerability/GO-2026-6602","tags":["ADVISORY"],"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","origins":[{"source":"go","sourceId":"GO-2026-6602","url":"https://osv.dev/vulnerability/GO-2026-6602"},{"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","url":"https://osv.dev/vulnerability/GO-2026-6602"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94447","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-94447"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548342","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548342"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94447","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-94447"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94447","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94447"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87040","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87040"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:86093","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:86093"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:86203","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:86203"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87246","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87246"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87245","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87245"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87041","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87041"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87042","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87042"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:87043","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:87043"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:86196","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:86196"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:79720","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:79720"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:79715","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:79715"}]},{"source":"euvd","sourceId":"EUVD-2026-95418","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95418","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-95418","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95418"}]}],"packages":[{"source":"go","sourceId":"GO-2026-6602","url":"https://osv.dev/vulnerability/GO-2026-6602","ecosystem":"Go","name":"toolchain","purl":"pkg:golang/toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.9"},{"introduced":"1.27.0-0"},{"fixed":"1.27.2"}]}],"ecosystemSpecific":{"imports":[{"path":"cmd/go"}]},"databaseSpecific":{"source":"https://vuln.go.dev/ID/GO-2026-6602.json"},"modified":"2026-10-16T09:55:44.518918993Z","origins":[{"source":"go","sourceId":"GO-2026-6602","modified":"2026-10-16T09:55:44.518918993Z","url":"https://osv.dev/vulnerability/GO-2026-6602"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-10.0.Z.E2S:go-toolset-0:1.26.10-1.el10_0.aarch64","product":"go-toolset-0:1.26.10-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87040"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/go-toolset@1.26.10-1.el10_0?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-10.0.Z.E2S:golang-bin-0:1.26.10-1.el10_0.s390x","product":"golang-bin-0:1.26.10-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87040"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-bin@1.26.10-1.el10_0?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-10.2.Z:go-toolset-0:1.26.10-1.el10_2.s390x","product":"go-toolset-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86093"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/go-toolset@1.26.10-1.el10_2?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-10.2.Z:golang-docs-0:1.26.10-1.el10_2.noarch","product":"golang-docs-0:1.26.10-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86093"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-docs@1.26.10-1.el10_2?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.26.1-1.module+el8.10.0+24516+40554724.x86_64::go-toolset:rhel8","product":"delve-0:1.26.1-1.module+el8.10.0+24516+40554724.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86203"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/delve@1.26.1-1.module%2Bel8.10.0%2B24516%2B40554724?arch=x86_64&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le::go-toolset:rhel8","product":"golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86203"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-1.module%2Bel8.10.0%2B25107%2B6b50279c?arch=ppc64le&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le::go-toolset:rhel8","product":"golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86203"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-race@1.26.10-1.module%2Bel8.10.0%2B25107%2B6b50279c?arch=ppc64le&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.6.0.Z.AUS:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8","product":"golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87246"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64&rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.6.0.Z.EUS.EXTENSION:golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src::go-toolset:rhel8","product":"golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87246"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-4.module%2Bel8.6.0%2B25114%2B90ecdb41?arch=src&rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.8.0.Z.E4S:delve-debuginfo-0:1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8","product":"delve-debuginfo-0:1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87245"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/delve-debuginfo@1.26.1-1.module%2Bel8.8.0%2B24781%2B86ad105d?arch=ppc64le&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.8.0.Z.E4S:golang-docs-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.noarch::go-toolset:rhel8","product":"golang-docs-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87245"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-docs@1.26.10-4.module%2Bel8.8.0%2B25113%2Ba148ecc0?arch=noarch&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-8.8.0.Z.TUS:golang-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.src::go-toolset:rhel8","product":"golang-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87245"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-4.module%2Bel8.8.0%2B25113%2Ba148ecc0?arch=src&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.2.0.Z.E4S:golang-0:1.26.10-1.el9_2.aarch64","product":"golang-0:1.26.10-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87041"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-1.el9_2?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.2.0.Z.E4S:golang-race-0:1.26.10-1.el9_2.aarch64","product":"golang-race-0:1.26.10-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87041"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-race@1.26.10-1.el9_2?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.4.0.Z.E4S:golang-0:1.26.10-1.el9_4.ppc64le","product":"golang-0:1.26.10-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87042"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-1.el9_4?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.4.0.Z.E4S:golang-race-0:1.26.10-1.el9_4.s390x","product":"golang-race-0:1.26.10-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87042"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-race@1.26.10-1.el9_4?arch=s390x","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.6.0.Z.EUS:golang-0:1.26.10-1.el9_6.src","product":"golang-0:1.26.10-1.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87043"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang@1.26.10-1.el9_6?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.6.0.Z.EUS:golang-race-0:1.26.10-1.el9_6.x86_64","product":"golang-race-0:1.26.10-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:87043"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-race@1.26.10-1.el9_6?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:golang-bin-0:1.26.10-1.el9_8.aarch64","product":"golang-bin-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86196"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-bin@1.26.10-1.el9_8?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:golang-tests-0:1.26.10-1.el9_8.noarch","product":"golang-tests-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:86196"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang-tests@1.26.10-1.el9_8?arch=noarch","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"Red Hat Hardened Images:golang1.26-misc-0:1.26.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"golang1.26-misc-0:1.26.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:79720"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang1.26-misc@1.26.9-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"Red Hat Hardened Images:golang1.27-docs-0:1.27.2-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"golang1.27-docs-0:1.27.2-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:79715"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang1.27-docs@1.27.2-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"Red Hat Hardened Images:golang1.27-tests-0:1.27.2-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"golang1.27-tests-0:1.27.2-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:79715"},{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."}],"purl":"pkg:rpm/redhat/golang1.27-tests@1.27.2-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"exploit_intelligence:exploit-intelligence/vulnerability-analysis-rhel9","product":"exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:oci/vulnerability-analysis-rhel9@sha256:9e846f56a5aeee9b65fbfee6dd2825113db854aef8dd0d5806df93fdcf2622e7?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"migration_toolkit_for_applications_8:mta/mta-go-external-provider-rhel9","product":"mta/mta-go-external-provider-rhel9 as a component of Migration Toolkit for Applications 8","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/mta-go-external-provider-rhel9@sha256:d6133e30119f504c5dd33ef1c30b7764143264aca5487267594bc64f3342e583?repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_enterprise_linux_10:ubi10/go-toolset","product":"ubi10/go-toolset as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/go-toolset@sha256:e7e1209b99b87956d6f85b0e115c0711af3515741acaa3c0a781233f8e5b0b02?repository_url=registry.redhat.io/ubi10/go-toolset","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_enterprise_linux_8:ubi8/go-toolset","product":"ubi8/go-toolset as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/go-toolset@sha256:c9616928bdf5591a758f588adac9bc0212a0a4ec929222a0f1629ec90c29aa41?repository_url=registry.redhat.io/ubi8/go-toolset","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_enterprise_linux_9:ubi9/go-toolset","product":"ubi9/go-toolset as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/go-toolset@sha256:8a523f9109ce1b18d2d83be3da4aa5d86191fc7b03a93605687117bf1a90d0db?repository_url=registry.redhat.io/ubi9/go-toolset","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_hardened_images:golang1.25.src","product":"golang1.25.src as a component of Red Hat Hardened Images","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:rpm/redhat/golang1.25@1.25.14-0.1.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_openshift_container_platform_4:openshift4/ose-operator-sdk-rhel8","product":"openshift4/ose-operator-sdk-rhel8 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-operator-sdk-rhel8@sha256:ef37a93fde22dc5946419ac5c8da0477ba54f33200fd094731d6df326f33c5a0?repository_url=registry.redhat.io/openshift4/ose-operator-sdk-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_openshift_container_platform_4:openshift4/ose-operator-sdk-rhel9","product":"openshift4/ose-operator-sdk-rhel9 as a component of Red Hat OpenShift Container Platform 4","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/ose-operator-sdk-rhel9@sha256:0aeb418a8af84652e1e719927938404250f8c9d68ad82ba275173a3d02d536d3?repository_url=registry.redhat.io/openshift4/ose-operator-sdk-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]},{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json","productId":"red_hat_openshift_dev_spaces:devspaces/udi-rhel9","product":"devspaces/udi-rhel9 as a component of Red Hat OpenShift Dev Spaces","status":"known_affected","remediations":[{"category":"workaround","details":"Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/udi-rhel9@sha256:d6242483b89e7711cd5f16ba83e6c4817f42b519136db7c94e673b16e9927f1e?repository_url=registry.redhat.io/devspaces/udi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-94447","modified":"2026-10-23T19:32:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94447.json"}]}],"vendorCoverage":{"total":259,"shown":32,"omitted":227,"source":"redhat"}}