RHSA-2026:80764 — Security Advisory

Red Hat Security Advisory: goose security update

Loading…

Severity

Important

Red Hat Product Security

RHEL 9

Products

Official CSAF product identity

Published · October 12, 2026

Updated · November 4, 2026

Topic

An update for goose is now available for Red Hat Enterprise Linux 9.

Description

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

Security Fix(es):

goose: Arbitrary command execution via malicious Git configuration in goose review (CVE-2026-72718)
goose: RMCP: Token impersonation via missing OAuth resource field validation (CVE-2026-63127)
goose: RMCP: Denial of Service via unauthenticated session table leak (CVE-2026-63128)
goose: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.