Vulnerability-Lookup

RHSA-2026:2706

Vulnerability from csaf_redhat - Published: 2026-02-16 09:40 - Updated: 2026-02-18 19:37

Summary

Red Hat Security Advisory: golang security update

Notes

Topic

An update for golang is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for golang is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2706",
        "url": "https://access.redhat.com/errata/RHSA-2026:2706"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2434431",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
      },
      {
        "category": "external",
        "summary": "2434432",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
      },
      {
        "category": "external",
        "summary": "2437016",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437016"
      },
      {
        "category": "external",
        "summary": "2437111",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2706.json"
      }
    ],
    "title": "Red Hat Security Advisory: golang security update",
    "tracking": {
      "current_release_date": "2026-02-18T19:37:51+00:00",
      "generator": {
        "date": "2026-02-18T19:37:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2026:2706",
      "initial_release_date": "2026-02-16T09:40:31+00:00",
      "revision_history": [
        {
          "date": "2026-02-16T09:40:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-16T09:40:31+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-18T19:37:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.1.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.25.7-1.el10_1.aarch64",
                "product": {
                  "name": "go-toolset-0:1.25.7-1.el10_1.aarch64",
                  "product_id": "go-toolset-0:1.25.7-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.25.7-1.el10_1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.25.7-1.el10_1.aarch64",
                "product": {
                  "name": "golang-0:1.25.7-1.el10_1.aarch64",
                  "product_id": "golang-0:1.25.7-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.25.7-1.el10_1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.25.7-1.el10_1.aarch64",
                "product": {
                  "name": "golang-bin-0:1.25.7-1.el10_1.aarch64",
                  "product_id": "golang-bin-0:1.25.7-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.25.7-1.el10_1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.25.7-1.el10_1.aarch64",
                "product": {
                  "name": "golang-race-0:1.25.7-1.el10_1.aarch64",
                  "product_id": "golang-race-0:1.25.7-1.el10_1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.25.7-1.el10_1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.25.7-1.el10_1.ppc64le",
                "product": {
                  "name": "go-toolset-0:1.25.7-1.el10_1.ppc64le",
                  "product_id": "go-toolset-0:1.25.7-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.25.7-1.el10_1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.25.7-1.el10_1.ppc64le",
                "product": {
                  "name": "golang-0:1.25.7-1.el10_1.ppc64le",
                  "product_id": "golang-0:1.25.7-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.25.7-1.el10_1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.25.7-1.el10_1.ppc64le",
                "product": {
                  "name": "golang-bin-0:1.25.7-1.el10_1.ppc64le",
                  "product_id": "golang-bin-0:1.25.7-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.25.7-1.el10_1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.25.7-1.el10_1.ppc64le",
                "product": {
                  "name": "golang-race-0:1.25.7-1.el10_1.ppc64le",
                  "product_id": "golang-race-0:1.25.7-1.el10_1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.25.7-1.el10_1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.25.7-1.el10_1.x86_64",
                "product": {
                  "name": "go-toolset-0:1.25.7-1.el10_1.x86_64",
                  "product_id": "go-toolset-0:1.25.7-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.25.7-1.el10_1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.25.7-1.el10_1.x86_64",
                "product": {
                  "name": "golang-0:1.25.7-1.el10_1.x86_64",
                  "product_id": "golang-0:1.25.7-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.25.7-1.el10_1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.25.7-1.el10_1.x86_64",
                "product": {
                  "name": "golang-bin-0:1.25.7-1.el10_1.x86_64",
                  "product_id": "golang-bin-0:1.25.7-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.25.7-1.el10_1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.25.7-1.el10_1.x86_64",
                "product": {
                  "name": "golang-race-0:1.25.7-1.el10_1.x86_64",
                  "product_id": "golang-race-0:1.25.7-1.el10_1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.25.7-1.el10_1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go-toolset-0:1.25.7-1.el10_1.s390x",
                "product": {
                  "name": "go-toolset-0:1.25.7-1.el10_1.s390x",
                  "product_id": "go-toolset-0:1.25.7-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/go-toolset@1.25.7-1.el10_1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-0:1.25.7-1.el10_1.s390x",
                "product": {
                  "name": "golang-0:1.25.7-1.el10_1.s390x",
                  "product_id": "golang-0:1.25.7-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.25.7-1.el10_1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-bin-0:1.25.7-1.el10_1.s390x",
                "product": {
                  "name": "golang-bin-0:1.25.7-1.el10_1.s390x",
                  "product_id": "golang-bin-0:1.25.7-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-bin@1.25.7-1.el10_1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-race-0:1.25.7-1.el10_1.s390x",
                "product": {
                  "name": "golang-race-0:1.25.7-1.el10_1.s390x",
                  "product_id": "golang-race-0:1.25.7-1.el10_1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-race@1.25.7-1.el10_1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-0:1.25.7-1.el10_1.src",
                "product": {
                  "name": "golang-0:1.25.7-1.el10_1.src",
                  "product_id": "golang-0:1.25.7-1.el10_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang@1.25.7-1.el10_1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "golang-docs-0:1.25.7-1.el10_1.noarch",
                "product": {
                  "name": "golang-docs-0:1.25.7-1.el10_1.noarch",
                  "product_id": "golang-docs-0:1.25.7-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-docs@1.25.7-1.el10_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-misc-0:1.25.7-1.el10_1.noarch",
                "product": {
                  "name": "golang-misc-0:1.25.7-1.el10_1.noarch",
                  "product_id": "golang-misc-0:1.25.7-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-misc@1.25.7-1.el10_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-src-0:1.25.7-1.el10_1.noarch",
                "product": {
                  "name": "golang-src-0:1.25.7-1.el10_1.noarch",
                  "product_id": "golang-src-0:1.25.7-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-src@1.25.7-1.el10_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "golang-tests-0:1.25.7-1.el10_1.noarch",
                "product": {
                  "name": "golang-tests-0:1.25.7-1.el10_1.noarch",
                  "product_id": "golang-tests-0:1.25.7-1.el10_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/golang-tests@1.25.7-1.el10_1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.25.7-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64"
        },
        "product_reference": "go-toolset-0:1.25.7-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.25.7-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le"
        },
        "product_reference": "go-toolset-0:1.25.7-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.25.7-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x"
        },
        "product_reference": "go-toolset-0:1.25.7-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go-toolset-0:1.25.7-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64"
        },
        "product_reference": "go-toolset-0:1.25.7-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.25.7-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64"
        },
        "product_reference": "golang-0:1.25.7-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.25.7-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le"
        },
        "product_reference": "golang-0:1.25.7-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.25.7-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x"
        },
        "product_reference": "golang-0:1.25.7-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.25.7-1.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src"
        },
        "product_reference": "golang-0:1.25.7-1.el10_1.src",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-0:1.25.7-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64"
        },
        "product_reference": "golang-0:1.25.7-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.25.7-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64"
        },
        "product_reference": "golang-bin-0:1.25.7-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.25.7-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le"
        },
        "product_reference": "golang-bin-0:1.25.7-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.25.7-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x"
        },
        "product_reference": "golang-bin-0:1.25.7-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-bin-0:1.25.7-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64"
        },
        "product_reference": "golang-bin-0:1.25.7-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-docs-0:1.25.7-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch"
        },
        "product_reference": "golang-docs-0:1.25.7-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-misc-0:1.25.7-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch"
        },
        "product_reference": "golang-misc-0:1.25.7-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.25.7-1.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64"
        },
        "product_reference": "golang-race-0:1.25.7-1.el10_1.aarch64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.25.7-1.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le"
        },
        "product_reference": "golang-race-0:1.25.7-1.el10_1.ppc64le",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.25.7-1.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x"
        },
        "product_reference": "golang-race-0:1.25.7-1.el10_1.s390x",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-race-0:1.25.7-1.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64"
        },
        "product_reference": "golang-race-0:1.25.7-1.el10_1.x86_64",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-src-0:1.25.7-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch"
        },
        "product_reference": "golang-src-0:1.25.7-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "golang-tests-0:1.25.7-1.el10_1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
        },
        "product_reference": "golang-tests-0:1.25.7-1.el10_1.noarch",
        "relates_to_product_reference": "AppStream-10.1.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T09:40:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2706"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-61728",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:39.965024+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736713",
          "url": "https://go.dev/cl/736713"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77102",
          "url": "https://go.dev/issue/77102"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4342",
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "release_date": "2026-01-28T19:30:31.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T09:40:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2706"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "cve": "CVE-2025-61732",
      "discovery_date": "2026-02-05T05:00:47.678207+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437016"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cmd/cgo: Potential code smuggling via doc comments in cmd/cgo",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437016",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437016"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61732",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/734220",
          "url": "https://go.dev/cl/734220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76697",
          "url": "https://go.dev/issue/76697"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4433",
          "url": "https://pkg.go.dev/vuln/GO-2026-4433"
        }
      ],
      "release_date": "2026-02-05T03:42:26.392000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T09:40:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2706"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cmd/cgo: Potential code smuggling via doc comments in cmd/cgo"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: Unexpected session resumption in crypto/tls",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
          "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
          "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
          "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
          "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T09:40:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2706"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:go-toolset-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.src",
            "AppStream-10.1.Z:golang-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-bin-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-docs-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-misc-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.aarch64",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.ppc64le",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.s390x",
            "AppStream-10.1.Z:golang-race-0:1.25.7-1.el10_1.x86_64",
            "AppStream-10.1.Z:golang-src-0:1.25.7-1.el10_1.noarch",
            "AppStream-10.1.Z:golang-tests-0:1.25.7-1.el10_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: Unexpected session resumption in crypto/tls"
    }
  ]
}

CVE-2025-68121 (GCVE-0-2025-68121)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:48 – Updated: 2026-02-06 15:35

Title

Unexpected session resumption in crypto/tls

Summary

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Severity ?

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

References

URL

Tags

	https://groups.google.com/g/golang-announce/c/K09…
	https://go.dev/cl/737700
	https://go.dev/issue/77217
	https://pkg.go.dev/vuln/GO-2026-4337

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/tls	Affected: 0 , < 1.24.13 (semver) Affected: 1.25.0-0 , < 1.25.7 (semver) Affected: 1.26.0-rc.1 , < 1.26.0-rc.3 (semver)

Credits

Coia Prant (github.com/rbqvq) Go Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-68121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-06T15:34:48.834956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-06T15:35:32.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.handshakeContext"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.7",
              "status": "affected",
              "version": "1.25.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.0-rc.3",
              "status": "affected",
              "version": "1.26.0-rc.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Coia Prant (github.com/rbqvq)"
        },
        {
          "lang": "en",
          "value": "Go Security Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T17:48:44.141Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "url": "https://go.dev/cl/737700"
        },
        {
          "url": "https://go.dev/issue/77217"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "title": "Unexpected session resumption in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-68121",
    "datePublished": "2026-02-05T17:48:44.141Z",
    "dateReserved": "2025-12-15T16:48:04.451Z",
    "dateUpdated": "2026-02-06T15:35:32.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61728 (GCVE-0-2025-61728)

Vulnerability from cvelistv5 – Published: 2026-01-28 19:30 – Updated: 2026-01-29 18:30

Title

Excessive CPU consumption when building archive index in archive/zip

Summary

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

References

URL

Tags

	https://go.dev/cl/736713
	https://go.dev/issue/77102
	https://groups.google.com/g/golang-announce/c/Vd2…
	https://pkg.go.dev/vuln/GO-2026-4342

Impacted products

	Vendor	Product	Version
	Go standard library	archive/zip	Affected: 0 , < 1.24.12 (semver) Affected: 1.25.0 , < 1.25.6 (semver)

Credits

Jakub Ciolek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-28T20:08:22.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/15/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-61728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T18:29:58.068724Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T18:30:24.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "archive/zip",
          "product": "archive/zip",
          "programRoutines": [
            {
              "name": "Reader.initFileList"
            },
            {
              "name": "Reader.Open"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.6",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Ciolek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T19:30:31.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/736713"
        },
        {
          "url": "https://go.dev/issue/77102"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4342"
        }
      ],
      "title": "Excessive CPU consumption when building archive index in archive/zip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-61728",
    "datePublished": "2026-01-28T19:30:31.354Z",
    "dateReserved": "2025-09-30T15:05:03.605Z",
    "dateUpdated": "2026-01-29T18:30:24.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61732 (GCVE-0-2025-61732)

Vulnerability from cvelistv5 – Published: 2026-02-05 03:42 – Updated: 2026-02-05 14:57

Title

Potential code smuggling via doc comments in cmd/cgo

Summary

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Severity ?

8.6 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

References

URL

Tags

	https://go.dev/cl/734220
	https://go.dev/issue/76697
	https://groups.google.com/g/golang-announce/c/K09…
	https://pkg.go.dev/vuln/GO-2026-4433

Impacted products

	Vendor	Product	Version
	Go toolchain	cmd/cgo	Affected: 0 , < 1.24.13 (semver) Affected: 1.25.0-0 , < 1.25.7 (semver)

Credits

RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-61732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T14:56:35.952364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T14:57:44.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/cgo",
          "product": "cmd/cgo",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.24.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.7",
              "status": "affected",
              "version": "1.25.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T03:42:26.392Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/734220"
        },
        {
          "url": "https://go.dev/issue/76697"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4433"
        }
      ],
      "title": "Potential code smuggling via doc comments in cmd/cgo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-61732",
    "datePublished": "2026-02-05T03:42:26.392Z",
    "dateReserved": "2025-09-30T15:05:03.606Z",
    "dateUpdated": "2026-02-05T14:57:44.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61726 (GCVE-0-2025-61726)

Vulnerability from cvelistv5 – Published: 2026-01-28 19:30 – Updated: 2026-01-29 18:31

Title

Memory exhaustion in query parameter parsing in net/url

Summary

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

References

URL

Tags

	https://go.dev/cl/736712
	https://go.dev/issue/77101
	https://groups.google.com/g/golang-announce/c/Vd2…
	https://pkg.go.dev/vuln/GO-2026-4341

Impacted products

	Vendor	Product	Version
	Go standard library	net/url	Affected: 0 , < 1.24.12 (semver) Affected: 1.25.0 , < 1.25.6 (semver)

Credits

jub0bs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-61726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T18:31:39.150633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T18:31:59.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "parseQuery"
            },
            {
              "name": "ParseQuery"
            },
            {
              "name": "URL.Query"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.6",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "jub0bs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T19:30:31.215Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/736712"
        },
        {
          "url": "https://go.dev/issue/77101"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "title": "Memory exhaustion in query parameter parsing in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-61726",
    "datePublished": "2026-01-28T19:30:31.215Z",
    "dateReserved": "2025-09-30T15:05:03.605Z",
    "dateUpdated": "2026-01-29T18:31:59.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:2706

CVE-2025-68121 (GCVE-0-2025-68121)

CVE-2025-61728 (GCVE-0-2025-61728)

CVE-2025-61732 (GCVE-0-2025-61732)

CVE-2025-61726 (GCVE-0-2025-61726)

Tags

Sightings

Nomenclature