Loading story…
Red Hat released multiple Important security advisories for containernetworking-plugins, skopeo, and git-lfs across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address CVE-2025-61729 in Go's crypto/x509, CVE-2025-61726 in net/url query parsing, and CVE-2025-68121 in crypto/tls; newer containernetworking-plugins advisories also include CVE-2026-25679, an IPv6 host literal parsing flaw in net/url. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on x86_64, aarch64, ppc64le, and s390x.
Upstream Go disclosures show the most prominent issue, CVE-2025-61729, can drive excessive CPU use during certificate hostname verification through inefficient handling in crypto/x509, including repeated hostname splitting and costly string processing in verification paths such as Certificate.Verify and VerifyHostname. Red Hat shipped fixed builds including containernetworking-plugins 1.7.1-3.el9_7, 1.6.2-3.el9_6, and 1.2.0-3.el9_2.3, skopeo 1.20.0-3.el10_1, and git-lfs 3.6.1-2.el10_0.2, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued advisory RHSA-2026:25251 for containernetworking-plugins on RHEL 9.2 channels, rated Important, fixing CVE-2025-61729, CVE-2025-61726, CVE-2025-68121, and CVE-2026-25679. Updated containernetworking-plugins 1.2.0-3.el9_2.3 packages were released for multiple architectures and lifecycle channels.
A Go issue described a performance denial-of-service problem in crypto/x509 hostname verification, where VerifyHostname repeatedly splits the same hostname for each DNS SAN entry. The issue notes the fix is to split the candidate hostname once and references release branches go1.25 and go1.26.
Red Hat issued advisory RHSA-2026:9109 for containernetworking-plugins on RHEL 9.6 channels, rated Important, fixing CVE-2025-61729, CVE-2025-61726, CVE-2025-68121, and CVE-2026-25679. Updated containernetworking-plugins 1.6.2-3.el9_6 packages were released for x86_64, aarch64, ppc64le, and s390x.
Red Hat issued advisory RHSA-2026:4166 for git-lfs, rated Important, to fix CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. Updated git-lfs 3.6.1-2.el10_0.2 packages were released for RHEL 10.0 Extended Update Support and related channels.
Red Hat issued advisory RHSA-2026:3341 for containernetworking-plugins on RHEL 9, rated Important, fixing CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. Updated containernetworking-plugins 1.7.1-3.el9_7 packages were released across multiple RHEL 9 architectures and support channels.
Red Hat issued advisory RHSA-2026:3343 for skopeo, rated Important, addressing Go vulnerabilities CVE-2025-61729, CVE-2025-61726, and CVE-2025-68121. Updated skopeo 1.20.0-3.el10_1 packages were released for multiple RHEL 10 variants and architectures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcego.dev
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcepkg.go.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat has issued a broad set of **Important** security advisories for container-focused packages including **podman**, **buildah**, **skopeo**, **runc**, and **containernetworking-plugins** across RHEL 8, 9, and 10, fixing denial-of-service flaws inherited from Go libraries. The recurring issues include `CVE-2026-32280`, `CVE-2026-32281`, and `CVE-2026-32283`, which affect certificate chain building and validation in `crypto/x509` and TLS 1.3 key update handling in `crypto/tls`; several advisories also include `CVE-2026-25679` in `net/url` and `CVE-2026-34986` in `go-jose`. Updated packages were released for multiple architectures and support channels, including standard, SAP, AUS, EUS, and Extended Life Cycle variants. The updates follow earlier tracking of Go certificate-processing weaknesses, including `CVE-2025-61729`, a high-severity `crypto/x509` denial-of-service bug in `HostnameError.Error()` that can be triggered by a crafted certificate to drive excessive CPU and memory consumption through unbounded host printing and quadratic string concatenation. Red Hat’s bug record linked that flaw to remediation across a wide range of products beyond container tooling, including Red Hat Enterprise Linux 7 through 10, OpenShift, Ansible Automation Platform, Ceph Storage, Satellite, OpenStack offerings, Cryostat, and Streams for Apache Kafka, underscoring the broad downstream impact of Go security defects on enterprise platforms.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026