Most recent entries from all

ALSA-2025:13935 — Important: golang security update

Affected: AlmaLinux:9: go-toolset, AlmaLinux:9: golang, AlmaLinux:9: golang-bin, AlmaLinux:9: golang-docs, AlmaLinux:9: golang-misc, AlmaLinux:9: golang-race, AlmaLinux:9: golang-src, AlmaLinux:9: golang-tests

The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-09875

BELL-CVE-2025-4674

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

BIT-golang-2025-4674 — Unexpected command execution in untrusted VCS repositories in cmd/go

Affected: Bitnami: golang

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

certfr-2025-avi-0751 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0751

Withdrawn: CLEANSTART-2026-AM62510 — gRPC-Go is the Go language implementation of gRPC

Withdrawn by the publisher.

Affected: CleanStart: consul-k8s-fips

Multiple security vulnerabilities affect the consul-k8s-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

EUVD-2026-259958

fkie_cve-2025-4674

GHSA-wprm-fgrx-xj42

msrc_CVE-2025-4674 — Unexpected command execution in untrusted VCS repositories in cmd/go

msrc_CVE-2025-4674

OESA-2025-2181 — golang security update

Affected: openEuler:24.03-LTS-SP1: golang

. Security Fix(es):

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

openSUSE-SU-2025:15328-1 — go1.23-1.23.11-1.1 on GA media

go1.23-1.23.11-1.1 on GA media

RHSA-2025:13936 — Red Hat Security Advisory: golang security update

cmd/go: Go VCS Command Execution Vulnerability

UBUNTU-CVE-2025-4674

Affected: Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:20.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.18, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.22 and 9 more

WID-SEC-W-2025-1516 — Golang Go: Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um Code zur Ausführung zu bringen