Critical Denial of Service Vulnerability in Go Toolset and Related Packages
Summary
ALSA-2026:0922: Important: golang security update. Affects go-toolset versions < 1.25.5-1.el10_1.alma.1. Fixed in 1.25.5-1.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, which is widely used for building scalable and high-performance applications. The toolset includes components such as the Go compiler, standard libraries, and documentation. This vulnerability affects multiple packages within the Go ecosystem on AlmaLinux 10, specifically versions prior to 1.25.5-1.el10_1.alma.1.
Vulnerability Detail
The vulnerability identified as CVE-2025-61729 is a Denial of Service (DoS) issue caused by excessive resource consumption when processing crafted certificates. An attacker can exploit this vulnerability by sending specially crafted certificates to a Go application, leading to resource exhaustion and potentially crashing the application. This vulnerability poses significant risks to applications relying on the Go programming language for secure communications.
How To Fix
Minimum fixed version
1.25.5-1.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on certificate processing or validating certificates in a controlled environment to mitigate the risk of resource exhaustion until the packages can be updated.
Conclusion
The Denial of Service vulnerability in the Go Toolset and related packages poses a significant risk to applications built with Go. It is crucial to update to the patched version to ensure the security and stability of your applications. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for go-toolset →
FAQ
CVE-2025-61729 is a Denial of Service vulnerability in the Go programming language that allows attackers to exhaust system resources through crafted certificates.
The affected packages include go-toolset, golang, golang-bin, golang-docs, golang-misc, golang-race, golang-src, and golang-tests on AlmaLinux 10.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If immediate updates are not possible, consider implementing rate limiting or other resource management strategies to mitigate the impact of the vulnerability.
For more details, refer to the CVE page associated with CVE-2025-61729, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
