Loading story…
Red Hat released a broad set of Important security advisories for rhc, image-builder, and delve across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as CVE-2025-61729, CVE-2025-61726, and, in many newer builds, CVE-2025-68121. The affected software includes rhc, which connects systems to Red Hat hosted management services, image-builder, which creates customized OS artifacts, and delve, the Go debugger. Updated packages were issued for multiple architectures including x86_64, aarch64, ppc64le, and s390x, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels.
The most prominent flaw, CVE-2025-61729, is rated Important by Red Hat with a CVSS 7.5 score and affects Go's crypto/x509 handling through unbounded string concatenation in HostnameError.Error(), allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to CWE-1050. The related fixes also address CVE-2025-61726, a memory exhaustion issue in Go net/url query parsing, and CVE-2025-68121, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as rhc 0.2.x/0.3.x, image-builder 31-3/31-4, and delve 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
19 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:19013 for delve on Red Hat Enterprise Linux 10, releasing version 1.26.1-1.el10_2. The Moderate-rated advisory fixed CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 across standard and extended RHEL 10.2 channels.
Red Hat issued RHSA-2026:7676 for rhc on Red Hat Enterprise Linux 7 Extended Lifecycle Support, releasing version 0.2.4-3.el7_9 for x86_64, s390x, and ppc64le. The Important-rated advisory fixed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:5077 for rhc on RHEL 9.6 Extended Update Support and related channels, releasing version 0.2.7-1.el9_6.1. The Important-rated update addressed CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 across multiple architectures.
Red Hat issued RHSA-2026:5078 for rhc on RHEL 9.4 Extended Update Support and related channels, releasing version 0.2.4-6.el9_4 across x86_64, aarch64, ppc64le, and s390x. The Important-rated advisory fixed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:5022 for rhc on RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service, releasing version 0.2.2-1.el8_8.1. The Important-rated update addressed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:5031 for rhc on several RHEL 8.6 service variants, releasing version 0.2.1-13.el8_6 for affected x86_64 and ppc64le systems. The Important-rated advisory fixed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:5030 for rhc on RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On, releasing rhc-0.2.0-5.el8_4. The Important-rated update addressed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:4907 for rhc in RHEL 10.0 Extended Update Support and related channels, releasing version 0.3.2-2.el10_0. The advisory fixed CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 and was rated Important.
Red Hat issued RHSA-2026:4892 for rhc on Red Hat Enterprise Linux 10, releasing version 0.3.4-2.el10_1 to remediate CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. The Important-rated update covered standard and extended RHEL 10.2 channels across four architectures.
Red Hat issued RHSA-2026:4901 for rhc on Red Hat Enterprise Linux 9, releasing version 0.2.7-2.el9_7 to address CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. The Important-rated advisory applied across x86_64, s390x, ppc64le, and aarch64 and related RHEL 9.8 channels.
Red Hat issued RHSA-2026:4952 for rhc on Red Hat Enterprise Linux 8, releasing version 0.2.5-4.el8_10 to fix CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. The Important-rated update covered multiple RHEL 8 architectures and Extended Life Cycle variants.
Red Hat issued RHSA-2026:3864 for delve on Red Hat Enterprise Linux 10, releasing version 1.25.2-2.el10_1 to remediate CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. The Important-rated update applied across standard, Extended Update Support, 4-year, and Extended Life Cycle RHEL 10.2 offerings.
Red Hat issued RHSA-2026:3843 for delve in RHEL 10.0 Extended Update Support and related 4-year channels, releasing delve 1.25.2-2.el10_0. The advisory fixed CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 and was rated Important.
Red Hat issued RHSA-2026:3840 for image-builder on Red Hat Enterprise Linux 10, releasing version 31-4.el10_1 to address CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. The Important-rated update covered x86_64, s390x, ppc64le, and aarch64 builds and related RHEL 10.2 channels.
Red Hat issued RHSA-2026:3839 for image-builder on Red Hat Enterprise Linux 9, releasing version 31-3.el9_7 to fix CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121 across multiple RHEL 9 architectures and support channels. The advisory rated the update Important.
Red Hat made the CVE-2025-61729 record public, describing a Go crypto/x509 denial-of-service flaw caused by unbounded string concatenation in HostnameError.Error() that can be triggered with a crafted certificate. Red Hat rated the issue Important with a CVSS v3.1 score of 7.5 and mapped it to CWE-1050.
The Go Project, acting as CNA, published CVE-2025-61729 for a crypto/x509 denial-of-service flaw in HostnameError.Error() caused by unbounded host printing and repeated string concatenation. The record said the issue can let a malicious certificate trigger excessive resource consumption and affects Go versions before 1.24.11 and 1.25.0 before 1.25.5.
Red Hat last modified its CVE-2025-61729 entry, retaining the Important severity and technical details while updating the record metadata and fixed-product listings. The entry continued to reference Bugzilla 2418462 and multiple related errata.
The Go Project published change list 725920 containing the upstream code fix for CVE-2025-61729 in crypto/x509. This represents the remediation development that downstream vendors later incorporated into their package updates.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
20 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcecve.org
Open sourcecwe.mitre.org
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026