CLSA-2026-1772124479
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1772124479.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CLSA-2026-1772124479
- Upstream
- Published
- 2026-03-02T10:30:03Z
- Modified
- 2026-05-27T11:17:48.731729719Z
- Summary
- golang: Fix of 7 CVEs
- Details
-
- Update to Go 1.25.7
- CVE-2025-61726: fixed DoS due to memory exhaustion flaw in net/url parameter parsing
- CVE-2025-61732: fixed RCE via code smuggling flaw in cgo comment parsing
- CVE-2025-68121: fixed security bypass in TLS where session resumption could ignore revoked or expired client certificates.
- CVE-2025-61731: fixed arbitrary code execution vulnerability in the go command toolchain involving unsafe cgo configuration flags.
- CVE-2025-68119: fixed arbitrary code execution risk when the go tool processes malicious version strings from external source control.
- CVE-2025-61730: fixed minor information disclosure in TLS 1.3 during specific encrypted handshake message transitions.
- CVE-2025-61727: fixed certificate validation bypass where specific wildcard domain constraints were not properly enforced by the security library.
- References