CVE-2025-0913: Go Standard Library - Inconsistent Handling of O_CREATE|O_EXCL on Unix and Windows
Summary
CVE-2025-0913: Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall. Affects stdlib across 2 version ranges.
< 1.23.10
>= 1.24.0-0, < 1.24.4
Fixed in 1.23.10 or 1.24.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-0913 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library is a collection of packages that provide essential functionality for Go applications, including file handling, networking, and more. It is widely used in various applications due to its simplicity and efficiency. However, the library has a vulnerability related to the os.OpenFile function, which can lead to inconsistent behavior when handling file creation flags across different operating systems.
Vulnerability Detail
The vulnerability arises from the inconsistent handling of the O_CREATE and O_EXCL flags in the os.OpenFile function on Unix and Windows systems. On Unix, these flags prevent the following of symlinks, ensuring that a file is not created if the target path is a dangling symlink. Conversely, on Windows, the same flags can lead to the creation of a file at a nonexistent symlink target, which can result in unexpected behavior and potential security risks. This inconsistency can lead to data corruption, unauthorized file access, or other unintended consequences.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.23.101.23.10go get stdlib@v1.23.10 -
>= 1.24.0-0, < 1.24.41.24.4go get stdlib@v1.24.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the O_CREATE and O_EXCL flags together with paths that may be symlinks. Instead, check if the target path is a symlink before attempting to open it with these flags.
Conclusion
In summary, CVE-2025-0913 highlights a critical inconsistency in the Go standard library's handling of file creation flags across different operating systems. It is essential to update to the patched versions to mitigate the risks associated with this vulnerability. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-0913 is a vulnerability in the Go standard library that affects the os.OpenFile function, leading to inconsistent behavior when handling file creation flags on Unix and Windows.
This vulnerability can lead to unexpected file creation behavior, potentially resulting in data corruption or unauthorized access to files in your application.
The vulnerability affects versions of the Go standard library prior to 1.23.10 and 1.24.4.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, avoid using the O_CREATE and O_EXCL flags with symlink paths as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
