ALSA-2026:2706 — Important: golang security update

Summary

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

Release	Package	Fixed in
AlmaLinux · 10	golang-docs	1.25.7-1.el10_1.alma.1
AlmaLinux · 10	golang-misc	1.25.7-1.el10_1.alma.1
AlmaLinux · 10	golang-src	1.25.7-1.el10_1.alma.1
AlmaLinux · 10	golang-tests	1.25.7-1.el10_1.alma.1

Vulnerabilities 4

Critical 9.1

CVE-2025-68121

Unexpected session resumption in crypto/tls

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026
High 8.6

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026
High 7.5

CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
Medium 6.5

CVE-2025-61728

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Go standard library archive/zip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026

References

report
https://access.redhat.com/security/cve/CVE-2025-61726
report
https://access.redhat.com/security/cve/CVE-2025-61728
report
https://access.redhat.com/security/cve/CVE-2025-61732
report
https://access.redhat.com/security/cve/CVE-2025-68121
report
https://bugzilla.redhat.com/2434431
report
https://bugzilla.redhat.com/2434432
report
https://bugzilla.redhat.com/2437016
report
https://bugzilla.redhat.com/2437111
advisory
https://errata.almalinux.org/10/ALSA-2026-2706.html