Critical Security Flaw in go-rpm-macros: IPv6 Host Literal Parsing Issue
Summary
RLSA-2026:8840: Important: go-rpm-macros security update. Affects go-rpm-macros versions < 0:3.6.0-8.el10_1. Fixed in 0:3.6.0-8.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The go-rpm-macros package is designed to facilitate the creation of Go language (golang) packages by providing build-stage RPM automation. It simplifies the process for developers by automatically pulling in necessary components for Go packages without needing to be included in the default build root. This package is particularly important for maintaining the integrity and efficiency of Go package management within the Rocky Linux ecosystem.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 stems from an incorrect parsing of IPv6 host literals in the net/url package. This flaw can lead to potential security risks, including the possibility of unauthorized access or manipulation of network requests. The issue arises from the way the package interprets IPv6 addresses, which could allow attackers to exploit this misconfiguration to redirect traffic or perform other malicious activities.
How To Fix
Minimum fixed version
0:3.6.0-8.el10_1
This is the first release that contains the fix.
sudo dnf update go-rpm-macrosTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the patch as soon as it is available.
Conclusion
The go-rpm-macros package has a critical vulnerability that needs immediate attention. Updating to the latest patched version is crucial to ensure the security of your systems. Monitoring tools like Vulert can help keep track of such vulnerabilities in real-time.
See every vulnerability recorded for go-rpm-macros →
FAQ
CVE-2026-25679 is a security vulnerability in the go-rpm-macros package that involves incorrect parsing of IPv6 host literals.
This vulnerability can potentially allow attackers to exploit misconfigured IPv6 addresses, leading to unauthorized access or manipulation of network requests.
You should update to the patched version of go-rpm-macros immediately to mitigate the risk associated with this vulnerability.
Yes, you can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for go-rpm-macros.
