TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
RHSA-2026:7879
go-toolset:rhel8 security update
Released 2026-04-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
Fixes 2 records
TI-2025-38133 CVE-2025-61731 · GHSA-xvqr-69v8-f3gv
Arbitrary file write using cgo pkg-config directive in cmd/go
Priority LOW 37
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.