Critical Security Flaw in Go Toolset: Arbitrary File Write and IPv6 Parsing Issues
Summary
ALSA-2026:5941: Important: golang security update. Affects go-toolset versions < 1.25.8-1.el10_1.alma.1. Fixed in 1.25.8-1.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, enabling developers to build, test, and deploy applications efficiently. It includes the Go compiler, standard libraries, and additional tools for package management and documentation. This toolset is widely used in various applications, making its security paramount. The recent vulnerabilities expose users to potential data corruption and unauthorized file access, which could compromise the integrity of applications built with Go.
Vulnerability Detail
The vulnerabilities identified in the Go Toolset stem from two critical issues: an arbitrary file write vulnerability due to a malicious pkg-config directive (CVE-2025-61731) and incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679). The arbitrary file write vulnerability allows an attacker to write files to arbitrary locations on the filesystem, potentially leading to data loss or corruption. The incorrect parsing of IPv6 host literals may lead to unexpected behavior in applications that rely on proper URL handling, which could be exploited for further attacks.
How To Fix
Minimum fixed version
1.25.8-1.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using pkg-config directives that are not from trusted sources and validate any URLs processed by the net/url package to ensure they conform to expected formats. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The vulnerabilities in the Go Toolset present significant risks to applications built with this programming language. By understanding the nature of these vulnerabilities and taking immediate action to update affected packages, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for go-toolset →
FAQ
The vulnerabilities include an arbitrary file write issue and incorrect parsing of IPv6 host literals, which can lead to unauthorized file access and application failures.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Update your Go Toolset and related packages to the patched version 1.25.8-1.el10_1.alma.1 as soon as possible to mitigate the risks associated with these vulnerabilities.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to gain unauthorized access or disrupt application functionality.
Detailed information can be found on the CVE pages for CVE-2025-61731 and CVE-2026-25679, which outline the vulnerabilities, their impact, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
