Most recent entries from all

ALSA-2025:22005 — Moderate: go-rpm-macros security update

Affected: AlmaLinux:9: go-filesystem, AlmaLinux:9: go-rpm-macros, AlmaLinux:9: go-rpm-templates, AlmaLinux:9: go-srpm-macros

This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-11595

BELL-CVE-2025-47906

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

BIT-golang-2025-47906 — Unexpected paths returned from LookPath in os/exec

Affected: Bitnami: golang

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

certfr-2025-avi-0935 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0935

Withdrawn: CLEANSTART-2026-AM62510 — gRPC-Go is the Go language implementation of gRPC

Withdrawn by the publisher.

Affected: CleanStart: consul-k8s-fips

Multiple security vulnerabilities affect the consul-k8s-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

EUVD-2026-259961

fkie_cve-2025-47906

GHSA-gwrf-jf3h-w649

msrc_CVE-2025-47906 — Unexpected paths returned from LookPath in os/exec

msrc_CVE-2025-47906

OESA-2025-2180 — golang security update

Affected: openEuler:22.03-LTS-SP4: golang

. Security Fix(es):

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

openSUSE-SU-2025:15420-1 — go1.25-1.25rc3-1.1 on GA media

go1.25-1.25rc3-1.1 on GA media

RHSA-2025:21856 — Red Hat Security Advisory: golang security update

os/exec: Unexpected paths returned from LookPath in os/exec golang: archive/tar: Unbounded allocation when parsing GNU sparse map

UBUNTU-CVE-2025-47906

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 21 more

WID-SEC-W-2025-1740 — Golang Go: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Dateien zu manipulieren.