Read the docs
TI-2025-38133 Aliases CVE-2025-61731GHSA-xvqr-69v8-f3gv

Arbitrary file write using cgo pkg-config directive in cmd/go

Priority LOW 37Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 30 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Partial cmd/go (Go toolchain): 1.24.12, 1.25.6Red Hat: 31 advisoriesRed Hat: 30 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.24.12; 1.25.0 to before 1.25.61.24.12, 1.25.6Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.24.12; 1.25.0 to before 1.25.6 Fixed in 1.24.12, 1.25.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.24.12; 1.25.0 to before 1.25.6VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.24.12; 1.25.0 to before 1.25.6 Vulnerable ·Go standard library

Remediation

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.24.12, 1.25.6

Red Hat 31 advisories

  • RHSA-2026:21691 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.13.67 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:20088 Released 2026-05-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:17598 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
Show 28 more Red Hat advisories
  • RHSA-2026:14774 Released 2026-05-13 · Red Hat rating Important
    OpenShift Container Platform 4.15.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:15091 Released 2026-05-12 · Red Hat rating Important
    OpenShift Container Platform 4.14.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:14100 Released 2026-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.89 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-tests
  • RHSA-2026:13736 Released 2026-05-06 · Red Hat rating Important
    OpenShift Container Platform 4.18.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-tests-rhel9
  • RHSA-2026:12282 Released 2026-05-06 · Red Hat rating Important
    OpenShift Container Platform 4.12.88 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:12118 Released 2026-05-06 · Red Hat rating Important
    OpenShift Container Platform 4.18.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:8448 Released 2026-04-22 · Red Hat rating Important
    OpenShift Container Platform 4.18.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
  • RHSA-2026:7883 Released 2026-04-13 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) golang-1.17.13-11.el9_0, golang-bin-1.17.13-11.el9_0, golang-docs-1.17.13-11.el9_0 +4
  • RHSA-2026:7876 Released 2026-04-13 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.aarch64::go-toolset:rhel8 +18
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
  • RHSA-2026:7877 Released 2026-04-13 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.ppc64le::go-toolset:rhel8 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.src::go-toolset:rhel8 +9
  • RHSA-2026:7879 Released 2026-04-13 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
  • RHSA-2026:7878 Released 2026-04-13 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.src::go-toolset:rhel8 +9
  • RHSA-2026:7834 Released 2026-04-13 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) go-toolset-1.21.13-15.el9_4, golang-1.21.13-15.el9_4, golang-bin-1.21.13-15.el9_4 +4
  • RHSA-2026:7833 Released 2026-04-13 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) golang-1.19.13-24.el9_2, golang-bin-1.19.13-24.el9_2, golang-docs-1.19.13-24.el9_2 +4
  • RHSA-2026:7385 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.25-1.25.9-1.hum1@aarch64, golang1.25-1.25.9-1.hum1@src, golang1.25-1.25.9-1.hum1@x86_64 +12
  • RHSA-2026:7291 Released 2026-04-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.26-1.26.2-1.hum1@aarch64, golang1.26-1.26.2-1.hum1@src, golang1.26-1.26.2-1.hum1@x86_64 +12
  • RHSA-2026:6949 Released 2026-04-08 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 +22
  • RHSA-2026:5952 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.2.3
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:5950 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.1.6
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:5948 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.0.9
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:5944 Released 2026-03-26 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.25.8-1.el9_6, golang-1.25.8-1.el9_6, golang-bin-1.25.8-1.el9_6 +5
  • RHSA-2026:5942 Released 2026-03-26 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.25.8-1.el9_7, golang-1.25.8-1.el9_7, golang-bin-1.25.8-1.el9_7 +5
  • RHSA-2026:5943 Released 2026-03-26 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.25.8-1.el10_0, golang-1.25.8-1.el10_0, golang-bin-1.25.8-1.el10_0 +5
  • RHSA-2026:5941 Released 2026-03-26 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.25.8-1.el10_1, golang-1.25.8-1.el10_1, golang-bin-1.25.8-1.el10_1 +5
  • RHSA-2026:4434 Released 2026-03-18 · Red Hat rating Important
    OpenShift Container Platform 4.19.26 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:3855 Released 2026-03-11 · Red Hat rating Important
    OpenShift Container Platform 4.20.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:3559 Released 2026-03-02 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.6.14
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/istio-cni-rhel8, registry.redhat.io/openshift-service-mesh/istio-rhel8-operator, registry.redhat.io/openshift-service-mesh/pilot-rhel8 +1
  • RHSA-2026:3556 Released 2026-03-02 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.6.14
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/proxyv2-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2AffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:5941
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:6949
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:5942
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:7878
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:7879
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:7876
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:7876
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:7877
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:7883
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:7833
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:5943
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:7834
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:5944
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:7879
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:7876
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:7877
Red Hat Hardened ImagesFixed RHSA-2026:7291, RHSA-2026:7385
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:12282, RHSA-2026:14100
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:21691
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:15091
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:14774
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:20088
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:17598
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:12118, RHSA-2026:13736, RHSA-2026:8448
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:4434
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:3855
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:3556, RHSA-2026:3559
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:5948
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:5950
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:5952
Not affected: 12 products
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Service Mesh 2.6
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift Service Mesh 3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61731
  2. 2026-10-03 Alias added: GHSA-xvqr-69v8-f3gv
  3. 2026-10-10 Affected versions changed · Red Hat

References

Patch 1

Advisory 1

Other 2

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences