[UPDATE] [medium] Golang Go-Module (Net, Image, Crypto): Multiple Vulnerabilities
An attacker can exploit multiple vulnerabilities in Golang Go to gain elevated privileges, conduct cross-site scripting attacks, bypass security measures, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities can lead to elevated privileges, cross-site scripting, security bypass, or denial of service.
- Who is affected
- An attacker can exploit these vulnerabilities.
- Urgency
- Remediation is medium urgency due to the moderate severity of the vulnerabilities.
- Action
- Update the Golang Go-Module to the latest version to mitigate the vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Golang Go-Module
Get an email when a new Golang Go-Module advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1653
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-256800.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-256810.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-271360.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398210.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425020.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425060.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-338090.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-425000.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398270.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-398280.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Golang Go: Multiple vulnerabilitiescert-bund
- high[NEW] [high] Oracle Solaris third-party components: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in IBM products (July 31, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in IBM products (July 17, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in IBM products (June 26, 2026)cert-fr-avis
- criticalGHSA-x527-x647-q7gg: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcementghsa
- criticalGHSA-5cgq-3rg8-m6cv: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked statusghsa
- criticalGHSA-rm3j-f69w-wqmq: golang.org/x/crypto vulnerable to infinite loop on large channel writesghsa
- criticalGHSA-89gr-r52h-f8rx: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassedghsa
- highGHSA-w879-237q-wc7r: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoSghsa
- criticalGHSA-vgwf-h737-ff37: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesghsa
- mediumGHSA-qpw4-5x99-6vjp: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSghsa
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25