Medium WID-SEC-2026-0129 6 CVEs

Golang Go: Mehrere Schwachstellen

Published Jan 15, 2026 · Updated Nov 10, 2026 · Revision 128 · de

Vendor: amazon Vendor: Dell Vendor: golang Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Splunk Vendor: SUSE Product: Ansible Automation Platform Product: App Connect Enterprise Product: Business Automation Workflow Product: Container-Optimized OS Product: Db2 Product: Enterprise Product: Enterprise Linux Product: Go Product: Integrated Dell Remote Access Controller Product: Linux Product: Linux Product: Linux 2 Product: openshift Product: OpenStack Product: openSUSE Product: Rocky Linux Product: Security Verify Access Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Go ist eine quelloffene Programmiersprache.

Vulnerabilities 6

Critical 9.1

CVE-2025-68121

Unexpected session resumption in crypto/tls

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026
High 7.8

CVE-2025-61731

Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config com…

Go toolchain cmd/go langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
High 7.5

CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
High 7.0

CVE-2025-68119

Unexpected code execution when invoking toolchain in cmd/go

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how exter…

Go toolchain cmd/go langfuse-3-worker golang Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
Medium 6.5

CVE-2025-61728

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Go standard library archive/zip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
Medium 5.3

CVE-2025-61730

Handshake messages may be processed at the incorrect encryption level in crypto/tls

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This c…

Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026

Revision history

2026-11-10 #128
Neue Updates von Red Hat aufgenommen
2026-11-08 #127
Neue Updates von Red Hat aufgenommen
2026-11-05 #126
Neue Updates von Red Hat aufgenommen
2026-11-04 #125
Neue Updates von Red Hat aufgenommen
2026-11-01 #124
Neue Updates von Red Hat aufgenommen
2026-10-28 #123
Neue Updates von Red Hat aufgenommen
2026-10-27 #122
Neue Updates von Red Hat aufgenommen
2026-10-26 #121
Neue Updates von Red Hat aufgenommen
2026-10-22 #120
Neue Updates von Red Hat aufgenommen
2026-10-21 #119
Neue Updates von Red Hat aufgenommen
2026-10-18 #118
Neue Updates von openSUSE aufgenommen
2026-10-15 #117
Neue Updates von Red Hat aufgenommen
2026-10-04 #116
Neue Updates von IBM aufgenommen
2026-09-28 #115
Neue Updates von Red Hat aufgenommen
2026-09-27 #114
Neue Updates von Red Hat aufgenommen
2026-09-20 #113
Neue Updates von Red Hat aufgenommen
2026-09-16 #112
Neue Updates von Red Hat aufgenommen
2026-09-14 #111
Neue Updates von Red Hat aufgenommen
2026-09-10 #110
Neue Updates von Red Hat aufgenommen
2026-09-03 #109
Neue Updates von Oracle Linux und Red Hat aufgenommen
2026-08-30 #108
Neue Updates von Red Hat aufgenommen
2026-08-26 #107
Neue Updates von Red Hat aufgenommen
2026-08-25 #106
Neue Updates von Red Hat aufgenommen
2026-08-18 #105
Neue Updates von Red Hat aufgenommen
2026-08-13 #104
Neue Updates von Red Hat aufgenommen

References

Go 1.25.6 and Go 1.24.12 release notes vom 2026-01-15
https://seclists.org/oss-sec/2026/q1/68
GitHub Golang Issue 77101 vom 2026-01-15
https://github.com/golang/go/issues/77101
GitHub Golang Issue 77102 vom 2026-01-15
https://github.com/golang/go/issues/77102
GitHub Golang Issue 76443 vom 2026-01-15
https://github.com/golang/go/issues/76443
GitHub Golang Issue 77100 vom 2026-01-15
https://github.com/golang/go/issues/77100
GitHub Golang Issue 77099 vom 2026-01-15
https://github.com/golang/go/issues/77099
GitHub Golang Issue 77113 vom 2026-01-15
https://github.com/golang/go/issues/77113
CoreDNS-1.14.1 Release Notes vom 2026-01-19
https://coredns.io/2026/01/15/coredns-1.14.-release/
openSUSE Security Update OPENSUSE-SU-2026:10063-1 vom 2026-01-19
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NH2ETRY5I4475P2G36TA426YNBGAZLJM/
openSUSE Security Update OPENSUSE-SU-2026:10064-1 vom 2026-01-19
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EJZDHBHKXYC7TOPJZKAU6QZKMN53VSVC/
SUSE Security Update SUSE-SU-2026:0219-1 vom 2026-01-22
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023866.html
SUSE Security Update SUSE-SU-2026:0218-1 vom 2026-01-22
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023867.html
SUSE Security Update SUSE-SU-2026:0298-1 vom 2026-01-27
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5Q63UO2LYEIXNPXRBOE6F42PWFVTQ6LQ/
SUSE Security Update SUSE-SU-2026:0297-1 vom 2026-01-27
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023924.html
SUSE Security Update SUSE-SU-2026:0296-1 vom 2026-01-26
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023920.html
SUSE Security Update SUSE-SU-2026:0308-1 vom 2026-01-28
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023937.html
SUSE Security Update SUSE-SU-2026:20122-1 vom 2026-01-28
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023968.html
openSUSE Security Update OPENSUSE-SU-2026:10101-1 vom 2026-01-28
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MQGDE5WRPP6NKEPWSYQ5WAJ54HTZCN45/
SUSE Security Update SUSE-SU-2026:20132-1 vom 2026-01-28
https://lists.suse.com/pipermail/sle-security-updates/2026-January/023959.html
openSUSE Security Update OPENSUSE-SU-2026:0032-1 vom 2026-01-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YIDNEL2XD2C3R7XQHANV23SKGOE6VLD6/
SUSE Security Update SUSE-SU-2026:0354-1 vom 2026-02-02
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024002.html
Amazon Linux Security Advisory ALAS2ECS-2026-095 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-095.html
Amazon Linux Security Advisory ALAS2-2026-3135 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3135.html
Amazon Linux Security Advisory ALAS2-2026-3134 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3134.html
Amazon Linux Security Advisory ALAS2DOCKER-2026-096 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-096.html
Amazon Linux Security Advisory ALAS2-2026-3138 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3138.html
Amazon Linux Security Advisory ALAS2-2026-3137 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3137.html
Amazon Linux Security Advisory ALAS2-2026-3136 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3136.html
Amazon Linux Security Advisory ALAS2-2026-3146 vom 2026-02-06
https://alas.aws.amazon.com/AL2/ALAS2-2026-3146.html
SUSE Security Update SUSE-SU-2026:0403-1 vom 2026-02-09
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024084.html
SUSE Security Update SUSE-SU-2026:0426-1 vom 2026-02-11
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024120.html
SUSE Security Update SUSE-SU-2026:0427-1 vom 2026-02-11
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024119.html
Red Hat Security Advisory RHSA-2026:2708 vom 2026-02-16
https://access.redhat.com/errata/RHSA-2026:2708
openSUSE Security Update OPENSUSE-SU-2026:20220-1 vom 2026-02-15
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M4EVFYENISTE7WMVDTI7MTPTDXI7IJQ2/
openSUSE Security Update OPENSUSE-SU-2026:20214-1 vom 2026-02-14
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KQX4ETITXJH3KBGH7YHJSZKMZNKVQRWR/
Red Hat Security Advisory RHSA-2026:2706 vom 2026-02-16
https://access.redhat.com/errata/RHSA-2026:2706
Red Hat Security Advisory RHSA-2026:2754 vom 2026-02-16
https://access.redhat.com/errata/RHSA-2026:2754
Oracle Linux Security Advisory ELSA-2026-2706 vom 2026-02-16
https://linux.oracle.com/errata/ELSA-2026-2706.html
Red Hat Security Advisory RHSA-2026:2681 vom 2026-02-16
https://access.redhat.com/errata/RHSA-2026:2681
Oracle Linux Security Advisory ELSA-2026-2709 vom 2026-02-16
https://linux.oracle.com/errata/ELSA-2026-2709.html
Oracle Linux Security Advisory ELSA-2026-2708 vom 2026-02-16
https://linux.oracle.com/errata/ELSA-2026-2708.html
Rocky Linux Security Advisory RLSA-2026:2708 vom 2026-02-17
https://errata.build.resf.org/RLSA-2026:2708
Rocky Linux Security Advisory RLSA-2026:2709 vom 2026-02-17
https://errata.build.resf.org/RLSA-2026:2709
Rocky Linux Security Advisory RLSA-2026:2706 vom 2026-02-17
https://errata.build.resf.org/RLSA-2026:2706
Amazon Linux Security Advisory ALAS2-2026-3174 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2-2026-3174.html
Amazon Linux Security Advisory ALAS2ECS-2026-096 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-096.html
SUSE Security Update SUSE-SU-2026:20429-1 vom 2026-02-18
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024343.html
SUSE Security Update SUSE-SU-2026:20428-1 vom 2026-02-18
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024344.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-087 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-087.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-088 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-088.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-089 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-089.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-090 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-090.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-091 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-091.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-092 vom 2026-02-19
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-092.html
Oracle Linux Security Advisory ELSA-2026-2920 vom 2026-02-19
https://linux.oracle.com/errata/ELSA-2026-2920.html
Oracle Linux Security Advisory ELSA-2026-2914 vom 2026-02-19
https://linux.oracle.com/errata/ELSA-2026-2914.html
openSUSE Security Update OPENSUSE-SU-2026:10220-1 vom 2026-02-19
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7N2QLT4QQIZC6RCBGA4LQNAUW5NSKRS/
openSUSE Security Update OPENSUSE-SU-2026:10224-1 vom 2026-02-19
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MP4XIIXIOQEITZJFXXLA5XOCW3MWGG7L/
Red Hat Security Advisory RHSA-2026:3035 vom 2026-02-23
https://access.redhat.com/errata/RHSA-2026:3035
Red Hat Security Advisory RHSA-2026:3040 vom 2026-02-23
https://access.redhat.com/errata/RHSA-2026:3040
Red Hat Security Advisory RHSA-2026:3089 vom 2026-02-23
https://access.redhat.com/errata/RHSA-2026:3089
Oracle Linux Security Advisory ELSA-2026-3092 vom 2026-02-24
http://linux.oracle.com/errata/ELSA-2026-3092.html
Oracle Linux Security Advisory ELSA-2026-3040 vom 2026-02-24
http://linux.oracle.com/errata/ELSA-2026-3040.html
Oracle Linux Security Advisory ELSA-2026-3035 vom 2026-02-24
http://linux.oracle.com/errata/ELSA-2026-3035.html
Red Hat Security Advisory RHSA-2026:3092 vom 2026-02-23
https://access.redhat.com/errata/RHSA-2026:3092
Red Hat Security Advisory RHSA-2026:3192 vom 2026-02-24
https://access.redhat.com/errata/RHSA-2026:3192
Red Hat Security Advisory RHSA-2026:3193 vom 2026-02-24
https://access.redhat.com/errata/RHSA-2026:3193
Red Hat Security Advisory RHSA-2026:3188 vom 2026-02-24
https://access.redhat.com/errata/RHSA-2026:3188
Red Hat Security Advisory RHSA-2026:3187 vom 2026-02-24
https://access.redhat.com/errata/RHSA-2026:3187
Red Hat Security Advisory RHSA-2026:3184 vom 2026-02-24
https://access.redhat.com/errata/RHSA-2026:3184
Red Hat Security Advisory RHSA-2026:3291 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3291
Rocky Linux Security Advisory RLSA-2026:3092 vom 2026-02-24
https://errata.build.resf.org/RLSA-2026:3092
Red Hat Security Advisory RHSA-2026:3298 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3298
Red Hat Security Advisory RHSA-2026:3297 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3297
Red Hat Security Advisory RHSA-2026:3337 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3337
Oracle Linux Security Advisory ELSA-2026-3187 vom 2026-02-25
https://linux.oracle.com/errata/ELSA-2026-3187.html
Red Hat Security Advisory RHSA-2026:3343 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3343
Red Hat Security Advisory RHSA-2026:3336 vom 2026-02-25
https://access.redhat.com/errata/RHSA-2026:3336
Oracle Linux Security Advisory ELSA-2026-3188 vom 2026-02-25
https://linux.oracle.com/errata/ELSA-2026-3188.html
Oracle Linux Security Advisory ELSA-2026-3297 vom 2026-02-25
https://linux.oracle.com/errata/ELSA-2026-3297.html