Critical Memory Exhaustion Vulnerability in Go RPM Macros and Related Packages
Summary
ALSA-2026:3669: Important: go-rpm-macros security update. Affects go-filesystem versions < 3.6.0-7.el10_1. Fixed in 3.6.0-7.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go RPM Macros package provides automation for building Go language (golang) packages, simplifying the process of creating and managing RPM packages for Go applications. It is not included in the default build root but is essential for Go packages. The affected packages include go-filesystem, go-rpm-macros, go-rpm-templates, and go-srpm-macros, all of which are integral to the Go packaging ecosystem in AlmaLinux 10.
Vulnerability Detail
The vulnerability identified as CVE-2025-61726 pertains to a memory exhaustion issue in the net/url package of the Go programming language. This vulnerability arises during the parsing of query parameters, which can lead to excessive memory consumption, potentially causing denial of service (DoS) conditions. Attackers could exploit this vulnerability by crafting malicious URLs that, when processed, consume significant system resources, impacting the availability of applications relying on this package.
How To Fix
Minimum fixed version
3.6.0-7.el10_1
This is the first release that contains the fix.
sudo dnf update go-filesystemTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size for query parameters in your application to mitigate the risk of memory exhaustion. This can be done by implementing validation checks before processing URLs, ensuring that they do not exceed a predefined length.
Conclusion
The memory exhaustion vulnerability in Go RPM Macros and related packages poses a significant risk to applications using these components. It is crucial to update to the patched versions to mitigate potential denial of service attacks. Implementing input validation can serve as a temporary workaround while updates are being applied.
See every vulnerability recorded for go-filesystem →
FAQ
CVE-2025-61726 is a vulnerability in the Go programming language's net/url package that can lead to memory exhaustion during query parameter parsing.
If your application processes URLs without proper validation, it may become susceptible to denial of service attacks, leading to downtime or degraded performance.
The affected packages include go-filesystem, go-rpm-macros, go-rpm-templates, and go-srpm-macros in the AlmaLinux 10 ecosystem.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to the Vulert playground.
If immediate updates are not possible, implement input validation to limit query parameter sizes and monitor your application for unusual behavior.
Related vulnerabilities
Recent vulnerabilities recorded for go-filesystem.
