Potential code smuggling via doc comments in cmd/cgo
Priority MEDIUM 40CWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 31 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-94.
Summary
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00531 45th percentileScored 2026-11-07
Fix Partial cmd/cgo (Go toolchain): 1.24.13, 1.25.7Red Hat: 31 advisoriesRed Hat: 31 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | cmd/cgo | before 1.24.13; 1.25.0-0 to before 1.25.7 | 1.24.13, 1.25.7 | Patch available | CNA |
- cmd/cgo VendorGo standard library Affected before 1.24.13; 1.25.0-0 to before 1.25.7 Fixed in 1.24.13, 1.25.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.24.13; 1.25.0 to before 1.25.7 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.24.13; 1.25.0 to before 1.25.7 Vulnerable ·Go standard library
Remediation
- Fix · CNA cmd/cgo (Go toolchain) Fixed in 1.24.13, 1.25.7
Red Hat 31 advisories
- RHSA-2026:21691 Released 2026-06-04 · Red Hat rating ImportantOpenShift Container Platform 4.13.67 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:17598 Released 2026-05-20 · Red Hat rating ImportantOpenShift Container Platform 4.17.54 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:14774 Released 2026-05-13 · Red Hat rating ImportantOpenShift Container Platform 4.15.64 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
Show 28 more Red Hat advisories
- RHSA-2026:15091 Released 2026-05-12 · Red Hat rating ImportantOpenShift Container Platform 4.14.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:14100 Released 2026-05-08 · Red Hat rating ImportantOpenShift Container Platform 4.12.89 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-tests
- RHSA-2026:12282 Released 2026-05-06 · Red Hat rating ImportantOpenShift Container Platform 4.12.88 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:10104 Released 2026-04-30 · Red Hat rating ImportantOpenShift Container Platform 4.16.60 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:8448 Released 2026-04-22 · Red Hat rating ImportantOpenShift Container Platform 4.18.38 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
- RHSA-2026:7385 Released 2026-04-10 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.25-1.25.9-1.hum1@aarch64, golang1.25-1.25.9-1.hum1@src, golang1.25-1.25.9-1.hum1@x86_64 +12
- RHSA-2026:7291 Released 2026-04-09 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images golang1.26-1.26.2-1.hum1@aarch64, golang1.26-1.26.2-1.hum1@src, golang1.26-1.26.2-1.hum1@x86_64 +12
- RHSA-2026:5878 Released 2026-04-01 · Red Hat rating ImportantOpenShift Container Platform 4.19.27 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cli-rhel9
- RHSA-2026:5952 Released 2026-03-26 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.2.3
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:5950 Released 2026-03-26 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.1.6
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:5948 Released 2026-03-26 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 3.0.9
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
- RHSA-2026:4434 Released 2026-03-18 · Red Hat rating ImportantOpenShift Container Platform 4.19.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:3855 Released 2026-03-11 · Red Hat rating ImportantOpenShift Container Platform 4.20.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:3559 Released 2026-03-02 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.6.14
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/istio-cni-rhel8, registry.redhat.io/openshift-service-mesh/istio-rhel8-operator, registry.redhat.io/openshift-service-mesh/pilot-rhel8 +1
- RHSA-2026:3556 Released 2026-03-02 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.6.14
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/proxyv2-rhel9
- RHSA-2026:3489 Released 2026-03-02 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
- Red Hat Enterprise Linux AppStream E4S (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.aarch64::go-toolset:rhel8 +18
- Red Hat Enterprise Linux AppStream TUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
- RHSA-2026:3471 Released 2026-03-02 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.ppc64le::go-toolset:rhel8 +12
- Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-4.module+el8.8.0+23976+18ba1869.src::go-toolset:rhel8 +9
- RHSA-2026:3469 Released 2026-03-02 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) go-toolset-1.21.13-14.el9_4, golang-1.21.13-14.el9_4, golang-bin-1.21.13-14.el9_4 +4
- RHSA-2026:3472 Released 2026-03-02 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) golang-1.19.13-23.el9_2, golang-bin-1.19.13-23.el9_2, golang-docs-1.19.13-23.el9_2 +4
- RHSA-2026:3468 Released 2026-03-02 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.src::go-toolset:rhel8 +9
- RHSA-2026:3473 Released 2026-03-02 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) golang-1.17.13-10.el9_0, golang-bin-1.17.13-10.el9_0, golang-docs-1.17.13-10.el9_0 +4
- RHSA-2026:3470 Released 2026-03-02 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
- RHSA-2026:3192 Released 2026-02-24 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.25.7-1.el10_0, golang-1.25.7-1.el10_0, golang-bin-1.25.7-1.el10_0 +5
- RHSA-2026:3193 Released 2026-02-24 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.25.7-1.el9_6, golang-1.25.7-1.el9_6, golang-bin-1.25.7-1.el9_6 +5
- RHSA-2026:2844 Released 2026-02-17 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.26.1 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-sshd-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +8
- RHSA-2026:2709 Released 2026-02-16 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.25.7-1.el9_7, golang-1.25.7-1.el9_7, golang-bin-1.25.7-1.el9_7 +5
- RHSA-2026:2708 Released 2026-02-16 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 +22
- RHSA-2026:2706 Released 2026-02-16 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.25.7-1.el10_1, golang-1.25.7-1.el10_1, golang-bin-1.25.7-1.el10_1 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| OpenShift Service Mesh 3 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:2706 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:2708 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:2709 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2026:3468 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:3470 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:3489 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2026:3489 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:3471 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:3473 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:3472 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:3192 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:3469 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:3193 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:3470 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2026:3489 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:3471 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7291, RHSA-2026:7385 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:12282, RHSA-2026:14100 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:21691 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:15091 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:14774 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:10104 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:17598 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:8448 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:4434, RHSA-2026:5878 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:3855 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 | Fixed | RHSA-2026:2844 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:3556, RHSA-2026:3559 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:5948 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:5950 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:5952 |
Not affected: 13 products
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
- Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61732
- 2026-10-03 Alias added: GHSA-8jvr-vh7g-f8gx
- 2026-10-10 Affected versions changed · Red Hat
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-61732 · CVE Program
- CVE-2025-61732 · NVD
- FIRST EPSS
- GHSA-8jvr-vh7g-f8gx · GitHub Advisory Database · CC BY 4.0
- CVE-2025-61732 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences