Resource exhaustion in Go programming language - CVE-2026-39820

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140608

Resource exhaustion in Go programming language - CVE-2026-39820

Published: July 31, 2026


Vulnerability identifier: #VU140608
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39820
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in net/mail address and date parsing functions when parsing well-crafted input. A remote attacker can send specially crafted input to cause a denial of service.


Affected software

Go programming language
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
butane (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
skopeo (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
ignition (Red Hat package)
kata-containers (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
microshift (Red Hat package)
grafana (Red Hat package)
osbuild-composer (Red Hat package)
Red Hat OpenShift Container Platform
Red Hat build of MicroShift

How to mitigate CVE-2026-39820

Install security update from vendor's website.

Go programming language - addressed in versions 1.25.10, 1.26.3
butane (Red Hat package) - addressed in versions 0.21.0-6.rhaos4.16.el8, 0.23.0-5.rhaos4.18.el8
runc (Red Hat package) - addressed in versions 1.2.9-5.rhaos4.16.el8, 1.2.9-5.rhaos4.16.el9, 1.2.9-7.rhaos4.18.el8, 1.2.9-7.rhaos4.18.el9
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-7.rhaos4.12.el8, 1.4.0-10.rhaos4.16.el8, 1.4.0-10.rhaos4.18.el8
skopeo (Red Hat package) - addressed in versions 1.9.4-9.rhaos4.12.el8, 1.9.4-10.rhaos4.12.el9, 1.14.5-8.rhaos4.16.el8, 1.14.5-8.rhaos4.16.el9, 1.16.1-6.rhaos4.18.el8, 1.16.1-7.rhaos4.18.el9
cri-tools (Red Hat package) - addressed in versions 1.25.0-6.el9, 1.25.0-7.el8, 1.29.0-8.el8, 1.29.0-8.el9, 1.31.1-7.el8, 1.31.1-7.el9
cri-o (Red Hat package) - addressed in versions 1.25.5-34.rhaos4.12.git6120b13.el8, 1.29.13-12.rhaos4.16.git979a5e6.el8, 1.29.13-12.rhaos4.16.git979a5e6.el9, 1.31.13-11.rhaos4.18.git817a650.el9, 1.31.13-12.rhaos4.18.git249255c.el8, 1.32.13-10.rhaos4.19.git1f1b94a.el9
ignition (Red Hat package) - addressed in versions 2.18.0-8.rhaos4.16.el9, 2.18.0-11.rhaos4.18.el9, 2.21.0-3.el10_0.4
kata-containers (Red Hat package) - update to 3.31.0-5.rhaos4.19.el9
openshift (Red Hat package) - addressed in versions 4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8, 4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el9, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8, 4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el9, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el8, 4.18.0-202608132034.p2.g91c2408.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.12.0-202608131627.p2.gd691257.assembly.stream.el8, 4.12.0-202608131627.p2.gd691257.assembly.stream.el9, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8, 4.16.0-202608111505.p2.g6f88b58.assembly.stream.el9, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el8, 4.18.0-202608132034.p2.g6febe61.assembly.stream.el9, 4.19.0-202608181135.p2.g522f35a.assembly.stream.el8, 4.19.0-202608181135.p2.g522f35a.assembly.stream.el9
Red Hat OpenShift Container Platform - addressed in versions 4.12.97, 4.16.69, 4.18.54, 4.19.44
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202608111505.p2.g26b43df.assembly.stream.el8, 4.16.0-202608111505.p2.g26b43df.assembly.stream.el9, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8, 4.18.0-202608121933.p2.g6ea2356.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8, 4.16.0-202608111505.p2.ga53e9de.assembly.stream.el9, 4.18.0-202608121933.p2.gc395190.assembly.stream.el8, 4.18.0-202608121933.p2.gc395190.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8, 4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el9, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el8, 4.18.0-202608121933.p2.g9795abd.assembly.stream.el9
Red Hat build of MicroShift - addressed in versions 4.18.54, 4.19.43
microshift (Red Hat package) - addressed in versions 4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9, 4.19.43-202608141837.p0.gcd3decf.assembly.4.19.43.el9
grafana (Red Hat package) - addressed in versions 9.2.10-33.el8_10, 10.2.6-28.el10_2.5
osbuild-composer (Red Hat package) - addressed in versions 76.1-9.el9_2, 101.3-4.el9_4.6, 132.2-12.el9_6

External References

Related Security Bulletins