TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
RHSA-2026:7877
go-toolset:rhel8 security update
Released 2026-04-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.ppc64le::go-toolset:rhel8 +12
- Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.src::go-toolset:rhel8 +9
Fixes 2 records
TI-2025-38133 CVE-2025-61731 · GHSA-xvqr-69v8-f3gv
Arbitrary file write using cgo pkg-config directive in cmd/go
Priority LOW 37
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.