Critical Security Flaw in Go Toolset: Arbitrary File Write and IPv6 Parsing Issues
Summary
ALSA-2026:5942: Important: golang security update. Affects go-toolset versions < 1.25.8-1.el9_7. Fixed in 1.25.8-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, which is widely used for building scalable and high-performance applications. It includes the Go compiler, standard libraries, and additional tools for development. This package is essential for developers working in environments that utilize Go, making it crucial to maintain its security and integrity.
Vulnerability Detail
The vulnerability arises from two critical issues: an arbitrary file write vulnerability due to a malicious pkg-config directive (CVE-2025-61731) and incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679). These vulnerabilities can lead to unauthorized file modifications and potential denial of service or data exposure, posing significant risks to applications relying on the Go Toolset.
How To Fix
Minimum fixed version
1.25.8-1.el9_7
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using pkg-config directives from untrusted sources and validate IPv6 addresses before processing them. This can help mitigate the risks associated with these vulnerabilities until the packages are updated.
Conclusion
The vulnerabilities in the Go Toolset pose significant risks to applications built with this programming language. It is crucial for developers to update their packages to the latest patched versions to ensure security. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for go-toolset →
FAQ
CVE-2025-61731 allows attackers to write arbitrary files on the system, which can lead to data corruption or unauthorized access.
CVE-2026-25679 can cause applications to misinterpret IPv6 addresses, potentially leading to connectivity issues or security vulnerabilities.
All versions prior to 1.25.8-1.el9_7 are affected by these vulnerabilities.
You can use Vulert to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities in your application.
While the best solution is to update, you can mitigate risks by avoiding untrusted pkg-config directives and validating IPv6 addresses.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
