Loading story…
The Go Project disclosed CVE-2025-61726, a denial-of-service flaw in the standard library's net/url handling that can be triggered through net/http.Request.ParseForm. The bug stems from the lack of a limit on query parameter counts, allowing attackers to submit URL-encoded forms with many unique parameters and drive excessive memory consumption. The issue affects Go releases before 1.24.12 and 1.25.x before 1.25.6, and is tracked in Go issue #77101 and Go advisory GO-2026-4341.
Red Hat subsequently shipped Important security updates for multiple products bundling vulnerable Go components, most notably grafana-pcp across RHEL 8, RHEL 9, and RHEL 10 channels, as well as golang-github-openprinting-ipp-usb on RHEL 10. Several advisories bundled fixes for related Go flaws, including CVE-2025-61729 in crypto/x509 and **CVE-2025-68121incrypto/tls, with updated packages released for x86_64, aarch64, ppc64le, and s390x` architectures across standard, SAP, AUS, EUS, and Extended Life Cycle offerings.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:3977 for golang-github-openprinting-ipp-usb on RHEL 10.0 channels, releasing ipp-usb version 0.9.27-3.el10_0.2. The update fixes Go vulnerabilities CVE-2025-61726 and CVE-2025-68121.
Red Hat published RHSA-2026:3822 for grafana-pcp on RHEL 9.0 Update Services for SAP Solutions, releasing version 3.2.0-5.el9_0. The update addresses CVE-2025-61726 and CVE-2025-61729.
Red Hat published RHSA-2026:3820 for grafana-pcp on RHEL 9.2 channels, releasing version 5.1.1-4.el9_2. The update addresses CVE-2025-61726 and CVE-2025-61729.
Red Hat published RHSA-2026:3817 for grafana-pcp on RHEL 9.6 channels, releasing version 5.1.1-12.el9_6. The update fixes CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
Red Hat published RHSA-2026:3816 for grafana-pcp on RHEL 10.0 channels, releasing version 5.2.2-4.el10_0. The update fixes CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
Red Hat published RHSA-2026:3187 for grafana-pcp on RHEL 8, releasing version 5.1.1-12.el8_10. The update remediates bundled Go vulnerabilities CVE-2025-61726 and CVE-2025-68121.
Red Hat published RHSA-2026:3035 for grafana-pcp on RHEL 10, releasing version 5.3.0-2.el10_1. The advisory addresses CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121 across multiple RHEL 10 variants and architectures.
Red Hat published RHSA-2026:3040 for grafana-pcp on RHEL 9, releasing version 5.1.1-12.el9_7. The update fixes bundled Go vulnerabilities including CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
The Go Project published the CVE record for CVE-2025-61726 and the Go vulnerability database entry GO-2026-4341. Both describe uncontrolled resource consumption in net/url query parsing that can be triggered through large URL-encoded forms handled by net/http.Request.ParseForm.
Go addressed CVE-2025-61726, a memory exhaustion flaw caused by unlimited query parameter parsing in net/url. The fix applies to versions before 1.24.12 and 1.25.x before 1.25.6, and is referenced by Go change list 736712 and issue 77101.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecve.org
Open sourcego.dev
Open sourcegroups.google.com
Open sourcego.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026
Red Hat released **Important** security updates for Go packages in **Red Hat Enterprise Linux 9** and **Red Hat Enterprise Linux 10**, addressing **CVE-2026-27137** and **CVE-2026-25679** across multiple architectures and support channels. The advisories, `RHSA-2026:19181` for RHEL 9 and `RHSA-2026:19022` for RHEL 10, update Go to `1.26.2+2` in the RHEL 9.8.z stream and `1.26.2-2.el10_2` in RHEL 10.2, with packages provided for `x86_64`, `s390x`, `ppc64le`, and `aarch64` systems, including Extended Update Support and Extended Life Cycle offerings. The more detailed flaw, **CVE-2026-25679**, affects Go's `net/url.Parse` function, which can incorrectly accept malformed URLs by failing to properly validate the host or authority component and by treating garbage before an IPv6 literal as ignorable. Red Hat rated that issue **Important** with a **CVSS 7.5** score and said no qualifying mitigation was available, while the second bug, **CVE-2026-27137**, affects Go's `crypto/x509` handling of email constraints. Organizations running Go workloads or development toolchains on supported RHEL releases should prioritize the updated `golang` and `go-toolset` packages to close both parsing and certificate-validation exposure.
Aug 20, 2026
Red Hat released a broad set of **Important** security advisories for `rhc`, `image-builder`, and `delve` across Red Hat Enterprise Linux 7, 8, 9, and 10 channels to fix Go-related vulnerabilities tracked as `CVE-2025-61729`, `CVE-2025-61726`, and, in many newer builds, `CVE-2025-68121`. The affected software includes `rhc`, which connects systems to Red Hat hosted management services, `image-builder`, which creates customized OS artifacts, and `delve`, the Go debugger. Updated packages were issued for multiple architectures including `x86_64`, `aarch64`, `ppc64le`, and `s390x`, spanning standard releases as well as Extended Update Support, SAP, Telecommunications, AUS, AMQCS, and Extended Life Cycle channels. The most prominent flaw, `CVE-2025-61729`, is rated **Important** by Red Hat with a CVSS 7.5 score and affects Go's `crypto/x509` handling through unbounded string concatenation in `HostnameError.Error()`, allowing a crafted certificate to trigger excessive resource consumption and denial of service; Red Hat maps it to **CWE-1050**. The related fixes also address `CVE-2025-61726`, a memory exhaustion issue in Go `net/url` query parsing, and `CVE-2025-68121`, which can cause unexpected TLS session resumption or incorrect certificate validation during session resumption. Red Hat said the vulnerabilities were remediated through package updates such as `rhc` 0.2.x/0.3.x, `image-builder` 31-3/31-4, and `delve` 1.25.2 and 1.26.1 builds across affected RHEL product lines.
Aug 20, 2026