Critical Security Update for Go Toolset and Related Packages: Arbitrary File Write and IPv6 Parsing Vulnerabilities
Summary
ALSA-2026:6949: Important: go-toolset:rhel8 security update. Affects delve versions < 1.25.2-1.module_el8.10.0+4074+24330916. Fixed in 1.25.2-1.module_el8.10.0+4074+24330916. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, also known as golang. It provides developers with the necessary resources to build and manage Go applications effectively. The toolset is widely used in various software projects due to its efficiency and performance. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing these tools.
Vulnerability Detail
The vulnerabilities stem from two main issues: 1) An arbitrary file write vulnerability in the cmd/go component, which can be exploited through a malicious pkg-config directive (CVE-2025-61731). This could allow attackers to write files to arbitrary locations on the system, potentially leading to unauthorized access or data corruption. 2) An incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679), which could result in improper handling of network requests, exposing applications to various network-based attacks.
How To Fix
Minimum fixed version
1.25.2-1.module_el8.10.0+4074+24330916
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the cmd/go tool with untrusted pkg-config directives and ensure that IPv6 host literals are properly validated before use. However, applying the updates is strongly recommended for long-term security.
Conclusion
In summary, the Go Toolset and related packages have been identified with critical vulnerabilities that could pose significant security risks. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for delve →
FAQ
The Go Toolset is a collection of tools and libraries for the Go programming language, designed to assist developers in building and managing Go applications.
The vulnerabilities could lead to arbitrary file writes and improper handling of network requests, potentially allowing attackers to gain unauthorized access or disrupt application functionality.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider implementing workarounds such as avoiding untrusted pkg-config directives and validating IPv6 host literals.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages associated with CVE-2025-61731 and CVE-2026-25679.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
