[UPDATE] [medium] Golang Go-Module (Net, Image, Crypto): Multiple Vulnerabilities
An attacker can exploit multiple vulnerabilities in Golang Go to gain elevated privileges, conduct cross-site scripting attacks, bypass security measures, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities can lead to elevated privileges, cross-site scripting, security bypass, or denial of service.
- Who is affected
- An attacker can exploit these vulnerabilities.
- Urgency
- Remediation is medium urgency due to the moderate severity of the vulnerabilities.
- Action
- Update the Golang Go-Module to the latest version to mitigate the vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Golang Go-Module
Get an email when a new Golang Go-Module advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1653
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-256800.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.
- Low exploitation riskCVE-2026-256810.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.
- Low exploitation riskCVE-2026-271360.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.
- Low exploitation riskCVE-2026-398210.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
- Low exploitation riskCVE-2026-425020.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all scored CVEs.
- Low exploitation riskCVE-2026-425060.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
- Low exploitation riskCVE-2026-338090.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all scored CVEs.
- Low exploitation riskCVE-2026-425000.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
- Low exploitation riskCVE-2026-398270.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
- Low exploitation riskCVE-2026-398280.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMultiple vulnerabilities in IBM products (June 26, 2026)cert-fr-avis
- criticalGHSA-x527-x647-q7gg: golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcementghsa
- criticalGHSA-5cgq-3rg8-m6cv: golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked statusghsa
- criticalGHSA-rm3j-f69w-wqmq: golang.org/x/crypto vulnerable to infinite loop on large channel writesghsa
- criticalGHSA-89gr-r52h-f8rx: golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassedghsa
- highGHSA-w879-237q-wc7r: golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoSghsa
- criticalGHSA-vgwf-h737-ff37: golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responsesghsa
- mediumGHSA-qpw4-5x99-6vjp: golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoSghsa
- mediumGHSA-78mq-xcr3-xm33: golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authentica…ghsa
- mediumGHSA-45gg-vh54-h5m9: golang.org/x/crypto vulnerable to invoking bypass of certificate restrictionsghsa
- highGHSA-q4h4-gmj2-qvw2: golang.org/x/crypto: Invoking byte arithmetic causes underflow and panicghsa
- criticalGHSA-f5wc-c3c7-36mc: golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keysghsa
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] DENX U-Boot: Multiple vulnerabilities allow execution of arbitrary code and DoS2026-07-10
- medium[NEW] [medium] Samsung Android: Multiple vulnerabilities2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10