Critical Arbitrary File Write and IPv6 Parsing Vulnerabilities in Golang Package
Summary
RLSA-2026:5942: Important: golang security update. Affects golang versions < 0:1.25.8-1.el9_7. Fixed in 0:1.25.8-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang package provides the Go programming language compiler, which is widely used for building efficient and reliable software. It includes tools for compiling code, managing dependencies, and running applications. However, recent vulnerabilities have been identified that could potentially compromise the security of applications built with this package.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, an arbitrary file write vulnerability caused by a malicious pkg-config directive (CVE-2025-61731), which could allow an attacker to write files to arbitrary locations on the filesystem. Second, an incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679) could lead to improper handling of network requests, potentially exposing sensitive information or allowing for further attacks. These vulnerabilities have a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
0:1.25.8-1.el9_7
This is the first release that contains the fix.
sudo dnf update golangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of pkg-config directives in your build process and validate IPv6 addresses before using them in your applications to mitigate the risks associated with these vulnerabilities.
Conclusion
In summary, the Golang package has critical vulnerabilities that could lead to arbitrary file writes and improper handling of IPv6 addresses. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to write files to arbitrary locations, potentially compromising system integrity and confidentiality.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score for these vulnerabilities is 8.6, indicating a high severity level.
Yes, the vulnerabilities are fixed in version 0:1.25.8-1.el9_7 of the Golang package.
If immediate updates are not possible, consider implementing workarounds such as restricting pkg-config directives and validating IPv6 addresses.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
