Most recent entries from all

ALSA-2026:2706 — Important: golang security update

Affected: AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02553

BELL-CVE-2025-61732

Affected: Alpaquita:23: go, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:stream: etcd, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

BIT-golang-2025-61732 — Potential code smuggling via doc comments in cmd/cgo

Affected: Bitnami: golang

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0199

Withdrawn: CLEANSTART-2026-AC65885 — Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: percona-xtradb-cluster-operator-fips

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-366076

fkie_cve-2025-61732

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

GHSA-8jvr-vh7g-f8gx

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

msrc_CVE-2025-61732 — Potential code smuggling via doc comments in cmd/cgo

msrc_CVE-2025-61732

OESA-2026-1698 — golang security update

Affected: openEuler:24.03-LTS-SP2: golang

The Go Programming Language. Security Fix(es):

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.(CVE-2025-61726)

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.(CVE-2025-61728)

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.(CVE-2025-61731)

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external…

openSUSE-SU-2026:10163-1 — go1.24-1.24.13-1.1 on GA media

go1.24-1.24.13-1.1 on GA media

RHSA-2026:10104 — Red Hat Security Advisory: OpenShift Container Platform 4.16.60 bug fix and security update

golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy axios: Axios: Remote Code Execution via Prototype Pollution escalation

SUSE-SU-2026:20428-1 — Security update for go1.25

Security update for go1.25

UBUNTU-CVE-2025-61732

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9, Ubuntu:20.04:LTS: golang-1.13 and 20 more

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

WID-SEC-W-2026-0345 — Golang Go: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsmaßnahmen zu umgehen.