Red Hat Security Advisory: go-toolset:rhel8 security update

Fixed packages 22

Vulnerabilities 2

• Medium 6.5
  CVE-2025-47906

  Unexpected paths returned from LookPath in os/exec

  If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

  Go standard library os/exec katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 18, 2025
• Medium 4.3
  CVE-2025-58183

  Unbounded allocation when parsing GNU sparse map in archive/tar

  tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archiv…

  Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 29, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396546
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2407258
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23741.json
• report
  https://access.redhat.com/security/cve/CVE-2025-47906
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-47906
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-47906
• article
  https://go.dev/cl/691775
• article
  https://go.dev/issue/74466
• article
  https://groups.google.com/g/golang-announce/c/x5MKroML2yM
• advisory
  https://pkg.go.dev/vuln/GO-2025-3956
• report
  https://access.redhat.com/security/cve/CVE-2025-58183
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-58183
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-58183
• article
  https://access.redhat.com/errata/RHSA-2026:3122
• article
  https://go.dev/cl/709861
• article
  https://go.dev/issue/75677
• article
  https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• advisory
  https://pkg.go.dev/vuln/GO-2025-4014