Red Hat Security Advisory: golang security update

Fixed packages 7

Vulnerabilities 3

• High 8.6
  CVE-2025-61732

  Potential code smuggling via doc comments in cmd/cgo

  A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

  Go toolchain cmd/cgo langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• High 7.5
  CVE-2025-61726

  Memory exhaustion in query parameter parsing in net/url

  The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2026
• Medium 6.5
  CVE-2025-61728

  Excessive CPU consumption when building archive index in archive/zip

  archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

  Go standard library archive/zip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2434431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2434432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2437016
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3472.json
• report
  https://access.redhat.com/security/cve/CVE-2025-61726
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61726
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61726
• article
  https://go.dev/cl/736712
• article
  https://go.dev/issue/77101
• article
  https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• advisory
  https://pkg.go.dev/vuln/GO-2026-4341
• report
  https://access.redhat.com/security/cve/CVE-2025-61728
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61728
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61728
• article
  https://go.dev/cl/736713
• article
  https://go.dev/issue/77102
• advisory
  https://pkg.go.dev/vuln/GO-2026-4342
• report
  https://access.redhat.com/security/cve/CVE-2025-61732
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61732
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61732
• article
  https://go.dev/cl/734220
• article
  https://go.dev/issue/76697
• article
  https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4433