Summary
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | delve | 1.25.2-1.module_el8.10.0+4074+24330916 |
| AlmaLinux · 8 | go-toolset | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-bin | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-docs | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-misc | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-race | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-src | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
| AlmaLinux · 8 | golang-tests | 1.25.8-1.module_el8.10.0+4156+92f0ae2f |
Vulnerabilities 2
-
High 7.8
Arbitrary file write using cgo pkg-config directive in cmd/go
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config com…
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.