Loading story…
Red Hat released multiple Important security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including gvisor-tap-vsock, git-lfs, rhc, HawtIO in the Red Hat build of Apache Camel, and the container-tools:rhel8 module. The updates primarily address CVE-2025-61729, a denial-of-service flaw in Go's crypto/x509 package that can be triggered by a crafted certificate during hostname verification, and CVE-2025-61726, a memory exhaustion issue in Go net/url query parsing. Some advisories also include fixes for CVE-2026-25679 in net/url, CVE-2024-24785 in html/template, and CVE-2025-65637 in logrus.
The underlying Go flaw tracked as GO-2025-4155 affects HostnameError.Error() in crypto/x509, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in Go 1.24.11 and Go 1.25.5 by limiting printed hosts and replacing repeated concatenation with strings.Builder, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as gvisor-tap-vsock 0.7.3-5.el9_4.3, git-lfs 2.13.3-3.el8_4.4, and rhc 0.2.1-12.el9_0.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:12033, an Important advisory for gvisor-tap-vsock on multiple RHEL 9.4 channels. Updated gvisor-tap-vsock 0.7.3-5.el9_4.3 packages fixed CVE-2025-61729, CVE-2025-61726, CVE-2025-68121, and CVE-2026-25679 across x86_64, s390x, ppc64le, and aarch64.
Red Hat published RHSA-2026:7942, an Important security update for HawtIO 4.3.1 in the Red Hat build of Apache Camel 4 GA Release. The advisory addressed CVE-2025-61726 and CVE-2025-61729 for the affected x86_64 product.
Red Hat issued RHSA-2026:5079 for rhc in RHEL 9.0 Update Services for SAP Solutions and related offerings, rating it Important. Updated rhc 0.2.1-12.el9_0 packages for x86_64, ppc64le, aarch64, and s390x fixed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:3973, an Important advisory for git-lfs on RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On. The update provided git-lfs 2.13.3-3.el8_4.4 and fixed CVE-2025-61729 and CVE-2025-61726.
Red Hat issued RHSA-2026:3428, an Important security advisory for the container-tools:rhel8 module in RHEL 8. The update addressed CVE-2024-24785, CVE-2025-61729, and CVE-2025-65637 across multiple architectures and included updated podman, buildah, runc, skopeo, and related packages.
The Go vulnerability database published GO-2025-4155 for CVE-2025-61729, describing a crypto/x509 hostname-verification flaw that can cause quadratic runtime and excessive resource consumption. The entry states affected versions are before 1.24.11 and from 1.25.0 before 1.25.5.
Go issue #76445 described excessive resource consumption in crypto/x509 HostnameError.Error(), caused by unlimited hostname printing and repeated string concatenation. The fix limited printed hosts and switched construction to strings.Builder on the go1.24 and go1.25 release branches.
A golang-announce security release published Go 1.24.11 and Go 1.25.5 to address CVE-2025-61729, a crypto/x509 denial-of-service issue. Later references identify these versions as the fixed releases for the flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcepkg.go.dev
Open sourcego.dev
Open sourcegroups.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories for `containernetworking-plugins`, `skopeo`, and `git-lfs` across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address `CVE-2025-61729` in Go's `crypto/x509`, `CVE-2025-61726` in `net/url` query parsing, and `CVE-2025-68121` in `crypto/tls`; newer `containernetworking-plugins` advisories also include `CVE-2026-25679`, an IPv6 host literal parsing flaw in `net/url`. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Upstream Go disclosures show the most prominent issue, `CVE-2025-61729`, can drive excessive CPU use during certificate hostname verification through inefficient handling in `crypto/x509`, including repeated hostname splitting and costly string processing in verification paths such as `Certificate.Verify` and `VerifyHostname`. Red Hat shipped fixed builds including `containernetworking-plugins` `1.7.1-3.el9_7`, `1.6.2-3.el9_6`, and `1.2.0-3.el9_2.3`, `skopeo` `1.20.0-3.el10_1`, and `git-lfs` `3.6.1-2.el10_0.2`, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Aug 20, 2026
Red Hat released a broad set of **Important** security advisories for `rhc`, `image-builder`, and `delve` across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as `CVE-2025-61729`, `CVE-2025-61726`, and, in many newer builds, `CVE-2025-68121`. The affected software includes `rhc`, which connects systems to Red Hat hosted management services, `image-builder`, which creates customized OS artifacts, and `delve`, the Go debugger. Updated packages were issued for multiple architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels. The most prominent flaw, `CVE-2025-61729`, is rated **Important** by Red Hat with a CVSS 7.5 score and affects Go's `crypto/x509` handling through unbounded string concatenation in `HostnameError.Error()`, allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to **CWE-1050**. The related fixes also address `CVE-2025-61726`, a memory exhaustion issue in Go `net/url` query parsing, and `CVE-2025-68121`, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as `rhc` 0.2.x/0.3.x, `image-builder` 31-3/31-4, and `delve` 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026