High ALAS2-2026-3172 1 CVE

Important: golang security update (Amazon Linux 2)

Published Feb 16, 2026 · Updated Feb 18, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61732: A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2	golang	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-bin	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-docs	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-misc	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-shared	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-src	0:1.24.13-1.amzn2.0.1
Amazon Linux · 2	golang-tests	0:1.24.13-1.amzn2.0.1

Vulnerabilities 1

High 8.6

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2025-61732.html