Vulnerability-Lookup

OPENSUSE-SU-2026:20220-1

Vulnerability from csaf_opensuse - Published: 2026-02-13 11:53 - Updated: 2026-02-13 11:53

Summary

Security update for go1.24

Notes

Title of the patch

Security update for go1.24

Description of the patch

This update for go1.24 fixes the following issues: Update to version 1.24.13. Security issues fixed: - CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling (bsc#1257692). - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (bsc#1256818). - CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain (bsc1256820). Other updates and bugfixes: - version update to 1.24.13: * go#77323 crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs * go#77424 crypto/tls: CL 737700 broke session resumption on macOS

Patchnames

openSUSE-Leap-16.0-270

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for go1.24",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for go1.24 fixes the following issues:\n\nUpdate to version 1.24.13.\n\nSecurity issues fixed:\n\n- CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing  allows for C code smuggling (bsc#1257692).\n- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does\n  not account for the expiration of full certificate chain (bsc#1256818).\n- CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain (bsc1256820).\n\nOther updates and bugfixes:\n\n- version update to 1.24.13:\n\n  * go#77323 crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs\n  * go#77424 crypto/tls: CL 737700 broke session resumption on macOS\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-270",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20220-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236217",
        "url": "https://bugzilla.suse.com/1236217"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256818",
        "url": "https://bugzilla.suse.com/1256818"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256820",
        "url": "https://bugzilla.suse.com/1256820"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257692",
        "url": "https://bugzilla.suse.com/1257692"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-61732 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-61732/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-68119 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-68119/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-68121 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-68121/"
      }
    ],
    "title": "Security update for go1.24",
    "tracking": {
      "current_release_date": "2026-02-13T11:53:30Z",
      "generator": {
        "date": "2026-02-13T11:53:30Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20220-1",
      "initial_release_date": "2026-02-13T11:53:30Z",
      "revision_history": [
        {
          "date": "2026-02-13T11:53:30Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.13-160000.1.1.aarch64",
                "product": {
                  "name": "go1.24-1.24.13-160000.1.1.aarch64",
                  "product_id": "go1.24-1.24.13-160000.1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.13-160000.1.1.aarch64",
                "product": {
                  "name": "go1.24-doc-1.24.13-160000.1.1.aarch64",
                  "product_id": "go1.24-doc-1.24.13-160000.1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-libstd-1.24.13-160000.1.1.aarch64",
                "product": {
                  "name": "go1.24-libstd-1.24.13-160000.1.1.aarch64",
                  "product_id": "go1.24-libstd-1.24.13-160000.1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.13-160000.1.1.aarch64",
                "product": {
                  "name": "go1.24-race-1.24.13-160000.1.1.aarch64",
                  "product_id": "go1.24-race-1.24.13-160000.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.13-160000.1.1.ppc64le",
                "product": {
                  "name": "go1.24-1.24.13-160000.1.1.ppc64le",
                  "product_id": "go1.24-1.24.13-160000.1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.13-160000.1.1.ppc64le",
                "product": {
                  "name": "go1.24-doc-1.24.13-160000.1.1.ppc64le",
                  "product_id": "go1.24-doc-1.24.13-160000.1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.13-160000.1.1.ppc64le",
                "product": {
                  "name": "go1.24-race-1.24.13-160000.1.1.ppc64le",
                  "product_id": "go1.24-race-1.24.13-160000.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.13-160000.1.1.s390x",
                "product": {
                  "name": "go1.24-1.24.13-160000.1.1.s390x",
                  "product_id": "go1.24-1.24.13-160000.1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.13-160000.1.1.s390x",
                "product": {
                  "name": "go1.24-doc-1.24.13-160000.1.1.s390x",
                  "product_id": "go1.24-doc-1.24.13-160000.1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.13-160000.1.1.s390x",
                "product": {
                  "name": "go1.24-race-1.24.13-160000.1.1.s390x",
                  "product_id": "go1.24-race-1.24.13-160000.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.13-160000.1.1.x86_64",
                "product": {
                  "name": "go1.24-1.24.13-160000.1.1.x86_64",
                  "product_id": "go1.24-1.24.13-160000.1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.13-160000.1.1.x86_64",
                "product": {
                  "name": "go1.24-doc-1.24.13-160000.1.1.x86_64",
                  "product_id": "go1.24-doc-1.24.13-160000.1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-libstd-1.24.13-160000.1.1.x86_64",
                "product": {
                  "name": "go1.24-libstd-1.24.13-160000.1.1.x86_64",
                  "product_id": "go1.24-libstd-1.24.13-160000.1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.13-160000.1.1.x86_64",
                "product": {
                  "name": "go1.24-race-1.24.13-160000.1.1.x86_64",
                  "product_id": "go1.24-race-1.24.13-160000.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.13-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64"
        },
        "product_reference": "go1.24-1.24.13-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.13-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le"
        },
        "product_reference": "go1.24-1.24.13-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.13-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x"
        },
        "product_reference": "go1.24-1.24.13-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.13-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64"
        },
        "product_reference": "go1.24-1.24.13-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.13-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64"
        },
        "product_reference": "go1.24-doc-1.24.13-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.13-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le"
        },
        "product_reference": "go1.24-doc-1.24.13-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.13-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x"
        },
        "product_reference": "go1.24-doc-1.24.13-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.13-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64"
        },
        "product_reference": "go1.24-doc-1.24.13-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-libstd-1.24.13-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64"
        },
        "product_reference": "go1.24-libstd-1.24.13-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-libstd-1.24.13-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64"
        },
        "product_reference": "go1.24-libstd-1.24.13-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.13-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64"
        },
        "product_reference": "go1.24-race-1.24.13-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.13-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le"
        },
        "product_reference": "go1.24-race-1.24.13-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.13-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x"
        },
        "product_reference": "go1.24-race-1.24.13-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.13-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
        },
        "product_reference": "go1.24-race-1.24.13-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-61732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-61732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-61732",
          "url": "https://www.suse.com/security/cve/CVE-2025-61732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257692 for CVE-2025-61732",
          "url": "https://bugzilla.suse.com/1257692"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T11:53:30Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-61732"
    },
    {
      "cve": "CVE-2025-68119",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-68119"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-68119",
          "url": "https://www.suse.com/security/cve/CVE-2025-68119"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256820 for CVE-2025-68119",
          "url": "https://bugzilla.suse.com/1256820"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T11:53:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-68119"
    },
    {
      "cve": "CVE-2025-68121",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-68121"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
          "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-68121",
          "url": "https://www.suse.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256818 for CVE-2025-68121",
          "url": "https://bugzilla.suse.com/1256818"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-doc-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-libstd-1.24.13-160000.1.1.x86_64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.aarch64",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.s390x",
            "openSUSE Leap 16.0:go1.24-race-1.24.13-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-13T11:53:30Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-68121"
    }
  ]
}

CVE-2025-68121 (GCVE-0-2025-68121)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:48 – Updated: 2026-02-20 16:05

Title

Unexpected session resumption in crypto/tls

Summary

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation

Assigner

References

URL

Tags

	https://groups.google.com/g/golang-announce/c/K09…
	https://go.dev/cl/737700
	https://go.dev/issue/77217
	https://pkg.go.dev/vuln/GO-2026-4337

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/tls	Affected: 0 , < 1.24.13 (semver) Affected: 1.25.0-0 , < 1.25.7 (semver) Affected: 1.26.0-rc.1 , < 1.26.0-rc.3 (semver)

Credits

Coia Prant (github.com/rbqvq) Go Security Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-68121",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T16:05:03.924102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-295",
                "description": "CWE-295 Improper Certificate Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T16:05:07.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.handshakeContext"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.24.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.7",
              "status": "affected",
              "version": "1.25.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.0-rc.3",
              "status": "affected",
              "version": "1.26.0-rc.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Coia Prant (github.com/rbqvq)"
        },
        {
          "lang": "en",
          "value": "Go Security Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T17:48:44.141Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "url": "https://go.dev/cl/737700"
        },
        {
          "url": "https://go.dev/issue/77217"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "title": "Unexpected session resumption in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-68121",
    "datePublished": "2026-02-05T17:48:44.141Z",
    "dateReserved": "2025-12-15T16:48:04.451Z",
    "dateUpdated": "2026-02-20T16:05:07.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61732 (GCVE-0-2025-61732)

Vulnerability from cvelistv5 – Published: 2026-02-05 03:42 – Updated: 2026-02-05 14:57

Title

Potential code smuggling via doc comments in cmd/cgo

Summary

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Severity ?

8.6 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

References

URL

Tags

	https://go.dev/cl/734220
	https://go.dev/issue/76697
	https://groups.google.com/g/golang-announce/c/K09…
	https://pkg.go.dev/vuln/GO-2026-4433

Impacted products

	Vendor	Product	Version
	Go toolchain	cmd/cgo	Affected: 0 , < 1.24.13 (semver) Affected: 1.25.0-0 , < 1.25.7 (semver)

Credits

RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-61732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T14:56:35.952364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T14:57:44.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/cgo",
          "product": "cmd/cgo",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.24.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.25.7",
              "status": "affected",
              "version": "1.25.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T03:42:26.392Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/734220"
        },
        {
          "url": "https://go.dev/issue/76697"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4433"
        }
      ],
      "title": "Potential code smuggling via doc comments in cmd/cgo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-61732",
    "datePublished": "2026-02-05T03:42:26.392Z",
    "dateReserved": "2025-09-30T15:05:03.606Z",
    "dateUpdated": "2026-02-05T14:57:44.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68119 (GCVE-0-2025-68119)

Vulnerability from cvelistv5 – Published: 2026-01-28 19:30 – Updated: 2026-02-26 15:04

Title

Unexpected code execution when invoking toolchain in cmd/go

Summary

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.

Severity ?

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

References

URL

Tags

	https://go.dev/cl/736710
	https://go.dev/issue/77099
	https://groups.google.com/g/golang-announce/c/Vd2…
	https://pkg.go.dev/vuln/GO-2026-4338

Impacted products

	Vendor	Product	Version
	Go toolchain	cmd/go	Affected: 1.25.0 , < 1.25.6 (semver)

Credits

splitline (@splitline) from DEVCORE Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-68119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T04:55:55.432053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:04:45.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.6",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "splitline (@splitline) from DEVCORE Research Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T19:30:30.704Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/736710"
        },
        {
          "url": "https://go.dev/issue/77099"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4338"
        }
      ],
      "title": "Unexpected code execution when invoking toolchain in cmd/go"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-68119",
    "datePublished": "2026-01-28T19:30:30.704Z",
    "dateReserved": "2025-12-15T16:48:04.450Z",
    "dateUpdated": "2026-02-26T15:04:45.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:20220-1

CVE-2025-68121 (GCVE-0-2025-68121)

CVE-2025-61732 (GCVE-0-2025-61732)

CVE-2025-68119 (GCVE-0-2025-68119)

Tags

Sightings

Nomenclature