Critical Vulnerability in Golang Package: Important Security Update Required
Summary
RLSA-2026:10217: Important: golang security update. Affects golang versions < 0:1.25.9-3.el10_1. Fixed in 0:1.25.9-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang package provides the Go programming language compiler, which is widely used for building efficient and reliable software. It includes various libraries and tools essential for developers to create applications. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built using this package.
Vulnerability Detail
The vulnerabilities stem from several issues within the Golang package, including improper handling of symlinks in the Root.Chmod function, which could allow unauthorized access. Additionally, there are Denial of Service vulnerabilities related to TLS 1.3 key updates and certificate chain building, which could disrupt service availability. Other issues include arbitrary code execution via malicious SWIG file names and potential memory corruption due to bound check elimination. These vulnerabilities can lead to severe security risks, including unauthorized access and service interruptions.
How To Fix
Minimum fixed version
0:1.25.9-3.el10_1
This is the first release that contains the fix.
sudo dnf update golangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected functionalities or disable the use of symlinks in your applications until the package is updated. However, this is not a permanent solution and should only be used until the patch is applied.
Conclusion
In summary, the Golang package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to protect your applications from potential security threats. Utilize tools like Vulert to monitor and assess your software for vulnerabilities effectively.
See every vulnerability recorded for golang →
FAQ
The CVSS score of this vulnerability is 9.0, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized access to system resources, Denial of Service attacks, and arbitrary code execution, which can compromise the integrity and availability of your applications.
Yes, a patch is available. You should update the Golang package to version 0:1.25.9-3.el10_1 or later to resolve the vulnerabilities.
If immediate updates are not possible, consider implementing temporary workarounds such as restricting access to affected functionalities or disabling symlink usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
