Red Hat Security Advisory: golang security update

Fixed packages 8

Vulnerabilities 2

• High 7.8
  CVE-2025-61731

  Arbitrary file write using cgo pkg-config directive in cmd/go

  Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config com…

  Go toolchain cmd/go langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2026
• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2434433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445356
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5941.json
• report
  https://access.redhat.com/security/cve/CVE-2025-61731
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61731
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61731
• article
  https://go.dev/cl/736711
• article
  https://go.dev/issue/77100
• article
  https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• advisory
  https://pkg.go.dev/vuln/GO-2026-4339
• report
  https://access.redhat.com/security/cve/CVE-2026-25679
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25679
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25679
• article
  https://go.dev/cl/752180
• article
  https://go.dev/issue/77578
• article
  https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4601