CVE-2025-4674

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

.

Security Fix(es):

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via 'go get', are not affected.(CVE-2025-4674)

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

.

Security Fix(es):

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via 'go get', are not affected.(CVE-2025-4674)

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

.

Security Fix(es):

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via 'go get', are not affected.(CVE-2025-4674)

A vulnerability was found in Google Go up to 1.23.11/1.24.5 (Programming Language Software). It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.(CVE-2025-47906)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.(CVE-2025-4674)

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line,…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)

Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.(CVE-2025-4674)

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to…

The golang packages provide the Go programming language compiler.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

• CVE-2025-4674: disallow multiple VCS metadata dirs in one module to prevent VCS injection attacks

The go command may execute unexpected commands when operating in untrusted VCS repositories.

This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and determine module versions.

These are all security issues fixed in the go1.23-1.23.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.24-1.24.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.25-1.25rc2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-4674 in the golang-1.24 package for Root:Debian:13. Multiple fixed versions available.

This update for go1.24 fixes the following issues:

• Update to version go1.24.5
• CVE-2025-4674: Fixed potential command execution in untrusted VCS repositories. (bsc#1246118)

This update for go1.23 fixes the following issues:

• Update to version go1.23.11
• CVE-2025-4674: Fixed potential command execution in untrusted VCS repositories. (bsc#1246118)

This update for go1.23-openssl fixes the following issues:

Updated to go1.23.12 (released 2025-08-06) (bsc#1229122):

• CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go (bsc#1246118)
• CVE-2025-47906: Fixed incorrect expansion of '', '.' and '..' in some PATH configurations in LookPath in osc/exec (bsc#1247719)
• CVE-2025-47907: Fixed incorrect results returned from Rows.Scan in database/sql (bsc#1247720)

Updated to version 1.23.12 cut from the go1.23-fips-release branch at the revision tagged go1.23.12-1-openssl-fips (jsc#SLE-18320)

• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

Other fixes:

• runtime: use-after-free of allpSnapshot in findRunnable
• runtime: segfaults in runtime.(*unwinder).next
• cmd/go: TestScript/build_trimpath_cgo fails to decode dwarf on release-branch.go1.23
• cmd/cgo/internal/testsanitizers: failures with signal: segmentation fault or exit status 66
• runtime: bad frame pointer during panic during duffcopy
• runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning
• internal/trace: stress tests triggering suspected deadlock in tracer
• runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile
• cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

This update for go1.24-openssl fixes the following issues:

Updated to go1.24.6 (released 2025-08-06) (bsc#1236217):

• CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go (bsc#1246118)
• CVE-2025-47906: Fixed incorrect expansion of '', '.' and '..' in some PATH configurations in LookPath in osc/exec (bsc#1247719)
• CVE-2025-47907: Fixed incorrect results returned from Rows.Scan in database/sql (bsc#1247720)

Updated to version 1.24.6 cut from the go1.24-fips-release branch at the revision tagged go1.24.6-1-openssl-fips. (jsc#SLE-18320)

• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

Other fixes:

• cmd/compile: regression on ppc64le bit operations
• cmd/go: crash on unknown GOEXPERIMENT during toolchain selection
• cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN
• internal/trace: stress tests triggering suspected deadlock in tracer
• os/user:nolibgcc: TestGroupIdsTestUser failures
• runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile
• runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not
• runtime: bad frame pointer during panic during duffcopy
• runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning
• runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk
• runtime: segfaults in runtime.(*unwinder).next
• runtime: use-after-free of allpSnapshot in findRunnable

go1.25 (released 2025-08-12) is a major release of Go.

go1.25.x minor releases will be provided through August 2026.

https://github.com/golang/go/wiki/Go-Release-Cycle

go1.25 arrives six months after Go 1.24. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before.

(boo#1244485 go1.25 release tracking)

• Language changes: There are no languages changes that affect Go programs in Go 1.25. However, in the language specification the notion of core types has been removed in favor of dedicated prose. See the respective blog post for more information.
• go command: The go build -asan option now defaults to doing leak detection at program exit. This will report an error if memory allocated by C is not freed and is not referenced by any other memory allocated by either C or Go. These new error reports may be disabled by setting ASAN_OPTIONS=detect_leaks=0 in the environment when running the program.
• go command: The Go distribution will include fewer prebuilt tool binaries. Core toolchain binaries such as the compiler and linker will still be included, but tools not invoked by build or test operations will be built and run by go tool as needed.
• go command: The new go.mod ignore directive can be used to specify directories the go command should ignore. Files in these directories and their subdirectories will be ignored by the go command when matching package patterns, such as all or ./..., but will still be included in module zip files.
• go command: The new go doc -http option will start a documentation server showing documentation for the requested object, and open the documentation in a browser window.
• go command: The new go version -m -json option will print the JSON encodings of the runtime/debug.BuildInfo structures embedded in the given Go binary files.
• go command: The go command now supports using a subdirectory of a repository as the path for a module root, when resolving a module path using the syntax <meta name='go-import' content='root-path vcs repo-url subdir'> to indicate that the root-path corresponds to the subdir of the repo-url with version control system vcs.
• go command: The new work package pattern matches all packages in the work (formerly called main) modules: either the single work module in module mode or the set of workspace modules in workspace mode.
• go command: When the go command updates the go line in a go.mod or go.work file, it no longer adds a toolchain line specifying the command’s current version.
• go vet: The go vet command includes new analyzers:
• go vet: waitgroup reports misplaced calls to sync.WaitGroup.Add;
• go vet: hostport reports uses of fmt.Sprintf('%s:%d', host, port) to construct addresses for net.Dial, as these will not work with IPv6; instead it suggests using net.JoinHostPort.
• Runtime: Container-aware GOMAXPROCS. The default behavior of the GOMAXPROCS has changed. In prior versions of Go, GOMAXPROCS defaults to the number of logical CPUs available at startup (runtime.NumCPU). Go 1.25 introduces two changes: On Linux, the runtime considers the CPU bandwidth limit of the cgroup containing the process, if any. If the CPU bandwidth limit is lower than the number of logical CPUs available, GOMAXPROCS will default to the lower limit. In container runtime systems like Kubernetes, cgroup CPU bandwidth limits generally correspond to the “CPU limit” option. The Go runtime does not consider the “CPU requests” option. On all OSes, the runtime periodically updates GOMAXPROCS if the number of logical CPUs available or the cgroup CPU bandwidth limit change. Both of these behaviors are automatically disabled if GOMAXPROCS is set manually via…

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.0 cut from the go1.25-fips-release branch at the revision tagged go1.25.0-1-openssl-fips. ( jsc#SLE-18320 )

• Rebase to 1.25.0
• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

go1.25 (released 2025-08-12) is a major release of Go. go1.25.x minor releases will be provided through August 2026. https://github.com/golang/go/wiki/Go-Release-Cycle

go1.25 arrives six months after Go 1.24. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before.

( bsc#1244485 go1.25 release tracking )

• Language changes: There are no languages changes that affect Go programs in Go 1.25. However, in the language specification the notion of core types has been removed in favor of dedicated prose. See the respective blog post for more information.
• go command: The go build -asan option now defaults to doing leak detection at program exit. This will report an error if memory allocated by C is not freed and is not referenced by any other memory allocated by either C or Go. These new error reports may be disabled by setting ASAN_OPTIONS=detect_leaks=0 in the environment when running the program.
• go command: The Go distribution will include fewer prebuilt tool binaries. Core toolchain binaries such as the compiler and linker will still be included, but tools not invoked by build or test operations will be built and run by go tool as needed.
• go command: The new go.mod ignore directive can be used to specify directories the go command should ignore. Files in these directories and their subdirectories will be ignored by the go command when matching package patterns, such as all or ./..., but will still be included in module zip files.
• go command: The new go doc -http option will start a documentation server showing documentation for the requested object, and open the documentation in a browser window.
• go command: The new go version -m -json option will print the JSON encodings of the runtime/debug.BuildInfo structures embedded in the given Go binary files.
• go command: The go command now supports using a subdirectory of a repository as the path for a module root, when resolving a module path using the syntax <meta name='go-import' content='root-path vcs repo-url subdir'> to indicate that the root-path corresponds to the subdir of the repo-url with version control system vcs.
• go command: The new work package pattern matches all packages in the work (formerly called main) modules: either the single work module in module mode or the set of workspace modules in workspace mode.
• go command: When the go command updates the go line in a go.mod or go.work file, it no longer adds a toolchain line specifying the command’s current version.
• go vet: The go vet command includes new analyzers:
• go vet: waitgroup reports misplaced calls to sync.WaitGroup.Add;
• go vet: hostport reports uses of fmt.Sprintf('%s:%d', host, port) to construct addresses for net.Dial, as these will not work with IPv6; instead it suggests using net.JoinHostPort.
• Runtime: Container-aware GOMAXPROCS. The default behavior of the GOMAXPROCS has changed. In prior versions of Go, GOMAXPROCS defaults to the number of logical CPUs available at startup (runtime.NumCPU). Go 1.25 introduces two changes: On Linux, the runtime considers the CPU bandwidth limit of the cgroup containing the process, if any. If the CPU bandwidth limit is lower than the number of logical CPUs available, GOMAXPROCS will default to the lower limit. In container runtime systems like Kubernetes, cgroup…

This security update of go1.24-openssl fixes the following issues:

Update to version 1.24.6 cut from the go1.24-fips-release branch at the revision tagged go1.24.6-1-openssl-fips. Refs jsc#SLE-18320

• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

go1.24.6 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime. ( boo#1236217 go1.24 release tracking)

CVE-2025-47906 CVE-2025-47907:

• go#74804 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations

• go#74833 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

• go#73800 runtime: RSS seems to have increased in Go 1.24 while the runtime accounting has not

• go#74416 runtime: use-after-free of allpSnapshot in findRunnable

• go#74694 runtime: segfaults in runtime.(*unwinder).next

• go#74760 os/user:nolibgcc: TestGroupIdsTestUser failures

go1.24.5 (released 2025-07-08) includes security fixes to the go command, as well as bug fixes to the compiler, the linker, the , and the go command. ( boo#1236217 go1.24 release tracking) j CVE-2025-4674:

• go#74381 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

• go#73908 runtime: bad frame pointer during panic during duffcopy

• go#74098 cmd/compile: regression on ppc64le bit operations

• go#74113 cmd/go: crash on unknown GOEXPERIMENT during toolchain selection

• go#74290 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning

• go#74294 internal/trace: stress tests triggering suspected deadlock in tracer

• go#74346 runtime: memlock not unlocked in all control flow paths in sysReserveAlignedSbrk

• go#74363 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile

• go#74403 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.24.4 (released 2025-06-05) includes security fixes to the crypto/x509, net/http, and os packages, as well as bug fixes to the linker, the go command, and the hash/maphash and os packages. ( boo#1236217 go1.24 release tracking)

CVE-2025-22874 CVE-2025-0913 CVE-2025-4673

• go#73700 go#73702 boo#1244158 security: fix CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation

• go#73720 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows

• go#73906 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

• go#73570 os: Root.Mkdir creates directories with zero permissions on OpenBSD

• go#73669 hash/maphash: hashing channels with purego impl. of maphash.Comparable panics

• go#73678 runtime/debug: BuildSetting does not document DefaultGODEBUG

• go#73809 cmd/go: add fips140 module selection mechanism

• go#73832 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen

This update for go1.23-openssl fixes the following issues:

Update to version 1.23.12 cut from the go1.23-fips-release branch at the revision tagged go1.23.12-1-openssl-fips. ( jsc#SLE-18320)

• Rebase to 1.23.12
• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

Packaging improvements:

• Update go_bootstrap_version to go1.21 from go1.20 to shorten the bootstrap chain. go1.21 can optionally be bootstrapped with gccgo and serve as the inital version of go1.x.
• Refs boo#1247816 bootstrap go1.21 with gccgo

go1.23.12 (released 2025-08-06) includes security fixes to the database/sql and os/exec packages, as well as bug fixes to the runtime.

CVE-2025-47906 CVE-2025-47907:

• go#74803 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations

• go#74832 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan

• go#74415 runtime: use-after-free of allpSnapshot in findRunnable

• go#74693 runtime: segfaults in runtime.(*unwinder).next

• go#74721 cmd/go: TestScript/build_trimpath_cgo fails to decode dwarf on release-branch.go1.23

• go#74726 cmd/cgo/internal/testsanitizers: failures with signal: segmentation fault or exit status 66

go1.23.11 (released 2025-07-08) includes security fixes to the go command, as well as bug fixes to the compiler, the linker, and the runtime.

CVE-2025-4674:

• go#74382 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module

• go#73907 runtime: bad frame pointer during panic during duffcopy

• go#74289 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning

• go#74293 internal/trace: stress tests triggering suspected deadlock in tracer

• go#74362 runtime/pprof: crash 'cannot read stack of running goroutine' in goroutine profile

• go#74402 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN

go1.23.10 (released 2025-06-05) includes security fixes to the net/http and os packages, as well as bug fixes to the linker. (boo#1229122 go1.23 release tracking)

CVE-2025-0913 CVE-2025-4673:

• go#73719 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows

• go#73905 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect

• go#73677 runtime/debug: BuildSetting does not document DefaultGODEBUG

• go#73831 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen

go1.23.9 (released 2025-05-06) includes fixes to the runtime and the linker. (boo#1229122 go1.23 release tracking)

• go#73091 cmd/link: linkname directive on userspace variable can override runtime variable
• go#73380 runtime, x/sys/unix: Connectx is broken on darwin/amd64

go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command.

CVE-2025-22871:

• go#72010 go#71988 boo#1240550 security: fix CVE-2025-22871 net/http: reject bare LF in chunked encoding

• go#72114 runtime: process hangs for mips hardware

• go#72871 runtime: cgo callback on extra M treated as external code after nested cgo callback returns

• go#72937 internal/godebugs: winsymlink and winreadlinkvolume have incorrect defaults for Go 1.22

go1.23.7 (released 2025-03-04) includes security fixes to the net/http package, as well as bug fixes to cgo, the compiler, and the reflect, runtime, and syscall packages.

CVE-2025-22870:

• go#71985 go#71984 boo#1238572 security: fix CVE-2025-22870 net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs

• go#71727 runtime: usleep computes wrong tv_nsec on s390x

• go#71839 runtime: recover added…

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.0 cut from the go1.25-fips-release branch at the revision tagged go1.25.0-1-openssl-fips. ( jsc#SLE-18320 )

• Rebase to 1.25.0
• Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil salt to be passed as a hash length buffer of zeros.

go1.25 (released 2025-08-12) is a major release of Go. go1.25.x minor releases will be provided through August 2026. https://github.com/golang/go/wiki/Go-Release-Cycle

go1.25 arrives six months after Go 1.24. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before.

( bsc#1244485 go1.25 release tracking )

• Language changes: There are no languages changes that affect Go programs in Go 1.25. However, in the language specification the notion of core types has been removed in favor of dedicated prose. See the respective blog post for more information.
• go command: The go build -asan option now defaults to doing leak detection at program exit. This will report an error if memory allocated by C is not freed and is not referenced by any other memory allocated by either C or Go. These new error reports may be disabled by setting ASAN_OPTIONS=detect_leaks=0 in the environment when running the program.
• go command: The Go distribution will include fewer prebuilt tool binaries. Core toolchain binaries such as the compiler and linker will still be included, but tools not invoked by build or test operations will be built and run by go tool as needed.
• go command: The new go.mod ignore directive can be used to specify directories the go command should ignore. Files in these directories and their subdirectories will be ignored by the go command when matching package patterns, such as all or ./..., but will still be included in module zip files.
• go command: The new go doc -http option will start a documentation server showing documentation for the requested object, and open the documentation in a browser window.
• go command: The new go version -m -json option will print the JSON encodings of the runtime/debug.BuildInfo structures embedded in the given Go binary files.
• go command: The go command now supports using a subdirectory of a repository as the path for a module root, when resolving a module path using the syntax <meta name='go-import' content='root-path vcs repo-url subdir'> to indicate that the root-path corresponds to the subdir of the repo-url with version control system vcs.
• go command: The new work package pattern matches all packages in the work (formerly called main) modules: either the single work module in module mode or the set of workspace modules in workspace mode.
• go command: When the go command updates the go line in a go.mod or go.work file, it no longer adds a toolchain line specifying the command’s current version.
• go vet: The go vet command includes new analyzers:
• go vet: waitgroup reports misplaced calls to sync.WaitGroup.Add;
• go vet: hostport reports uses of fmt.Sprintf('%s:%d', host, port) to construct addresses for net.Dial, as these will not work with IPv6; instead it suggests using net.JoinHostPort.
• Runtime: Container-aware GOMAXPROCS. The default behavior of the GOMAXPROCS has changed. In prior versions of Go, GOMAXPROCS defaults to the number of logical CPUs available at startup (runtime.NumCPU). Go 1.25 introduces two changes: On Linux, the runtime considers the CPU bandwidth limit of the cgroup containing the process, if any. If the CPU bandwidth limit is lower than the number of logical CPUs available, GOMAXPROCS will default to the lower limit. In container runtime systems like Kubernetes, cgroup…

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.6 (released 2026-01-15) (jsc#SLE-18320, bsc#1244485):

Security fixes:

• CVE-2025-4674 cmd/go: disable support for multiple vcs in one module (bsc#1246118).
• CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations (bsc#1247719).
• CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan (bsc#1247720).
• CVE-2025-47910 net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches (bsc#1249141).
• CVE-2025-47912 net/url: insufficient validation of bracketed IPv6 hostnames (bsc#1251257).
• CVE-2025-58183 archive/tar: unbounded allocation when parsing GNU sparse map (bsc#1251261).
• CVE-2025-58185 encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion (bsc#1251258).
• CVE-2025-58186 net/http: lack of limit when parsing cookies can cause memory exhaustion (bsc#1251259).
• CVE-2025-58187 crypto/x509: quadratic complexity when checking name constraints (bsc#1251254).
• CVE-2025-58188 crypto/x509: panic when validating certificates with DSA public keys (bsc#1251260).
• CVE-2025-58189 crypto/tls: ALPN negotiation error contains attacker controlled information (bsc#1251255).
• CVE-2025-61723 encoding/pem: quadratic complexity when parsing some invalid inputs (bsc#1251256).
• CVE-2025-61724 net/textproto: excessive CPU consumption in Reader.ReadResponse (bsc#1251262).
• CVE-2025-61725 net/mail: excessive CPU consumption in ParseAddress (bsc#1251253).
• CVE-2025-61726 net/http: memory exhaustion in Request.ParseForm (bsc#1256817).
• CVE-2025-61727 crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (bsc#1254430).
• CVE-2025-61728 archive/zip: denial of service when parsing arbitrary ZIP archives (bsc#1256816).
• CVE-2025-61729 crypto/x509: excessive resource consumption in printing error string for host certificate validation (bsc#1254431).
• CVE-2025-61730 crypto/tls: handshake messages may be processed at the incorrect encryption level (bsc#1256821).
• CVE-2025-61731 cmd/go: bypass of flag sanitization can lead to arbitrary code execution (bsc#1256819).
• CVE-2025-68119 cmd/go: unexpected code execution when invoking toolchain (bsc#1256820).
• CVE-2025-68121 crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (bsc#1256818).

Other fixes:

• go#74822 cmd/go: 'get toolchain@latest' should ignore release candidates
• go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets
• go#75008 os/exec: TestLookPath fails on plan9 after CL 685755
• go#75021 testing/synctest: bubble not terminating
• go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles
• go#75111 os, syscall: volume handles with FILE_FLAG_OVERLAPPED fail when calling ReadAt
• go#75116 os: Root.MkdirAll can return 'file exists' when called concurrently on the same path
• go#75139 os: Root.OpenRoot sets incorrect name, losing prefix of original root
• go#75221 debug/pe: pe.Open fails on object files produced by llvm-mingw 21
• go#75255 cmd/compile: export to DWARF types only referenced through interfaces
• go#75347 testing/synctest: test timeout with no runnable goroutines
• go#75357 net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
• go#75480 cmd/link: linker panic and relocation errors with complex generics inlining
• go#75524 crypto/internal/fips140/rsa: requires a panic if self-tests fail
• go#75537 context: Err can return non-nil before Done channel is closed
• go#75539 net/http: internal error: connCount underflow
• go#75595 cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
• go#75610 sync/atomic: comment for Uintptr.Or incorrectly describes…

This update for go1.25-openssl fixes the following issues:

Update to version 1.25.6 (released 2026-01-15) (jsc#SLE-18320, bsc#1244485):

Security fixes:

• CVE-2025-4674 cmd/go: disable support for multiple vcs in one module (bsc#1246118).
• CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of '', '.' and '..' in some PATH configurations (bsc#1247719).
• CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan (bsc#1247720).
• CVE-2025-47910 net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches (bsc#1249141).
• CVE-2025-47912 net/url: insufficient validation of bracketed IPv6 hostnames (bsc#1251257).
• CVE-2025-58183 archive/tar: unbounded allocation when parsing GNU sparse map (bsc#1251261).
• CVE-2025-58185 encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion (bsc#1251258).
• CVE-2025-58186 net/http: lack of limit when parsing cookies can cause memory exhaustion (bsc#1251259).
• CVE-2025-58187 crypto/x509: quadratic complexity when checking name constraints (bsc#1251254).
• CVE-2025-58188 crypto/x509: panic when validating certificates with DSA public keys (bsc#1251260).
• CVE-2025-58189 crypto/tls: ALPN negotiation error contains attacker controlled information (bsc#1251255).
• CVE-2025-61723 encoding/pem: quadratic complexity when parsing some invalid inputs (bsc#1251256).
• CVE-2025-61724 net/textproto: excessive CPU consumption in Reader.ReadResponse (bsc#1251262).
• CVE-2025-61725 net/mail: excessive CPU consumption in ParseAddress (bsc#1251253).
• CVE-2025-61726 net/http: memory exhaustion in Request.ParseForm (bsc#1256817).
• CVE-2025-61727 crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (bsc#1254430).
• CVE-2025-61728 archive/zip: denial of service when parsing arbitrary ZIP archives (bsc#1256816).
• CVE-2025-61729 crypto/x509: excessive resource consumption in printing error string for host certificate validation (bsc#1254431).
• CVE-2025-61730 crypto/tls: handshake messages may be processed at the incorrect encryption level (bsc#1256821).
• CVE-2025-61731 cmd/go: bypass of flag sanitization can lead to arbitrary code execution (bsc#1256819).
• CVE-2025-68119 cmd/go: unexpected code execution when invoking toolchain (bsc#1256820).
• CVE-2025-68121 crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain (bsc#1256818).

Other fixes:

• go#74822 cmd/go: 'get toolchain@latest' should ignore release candidates
• go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets
• go#75008 os/exec: TestLookPath fails on plan9 after CL 685755
• go#75021 testing/synctest: bubble not terminating
• go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles
• go#75111 os, syscall: volume handles with FILE_FLAG_OVERLAPPED fail when calling ReadAt
• go#75116 os: Root.MkdirAll can return 'file exists' when called concurrently on the same path
• go#75139 os: Root.OpenRoot sets incorrect name, losing prefix of original root
• go#75221 debug/pe: pe.Open fails on object files produced by llvm-mingw 21
• go#75255 cmd/compile: export to DWARF types only referenced through interfaces
• go#75347 testing/synctest: test timeout with no runnable goroutines
• go#75357 net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
• go#75480 cmd/link: linker panic and relocation errors with complex generics inlining
• go#75524 crypto/internal/fips140/rsa: requires a panic if self-tests fail
• go#75537 context: Err can return non-nil before Done channel is closed
• go#75539 net/http: internal error: connCount underflow
• go#75595 cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
• go#75610 sync/atomic: comment for Uintptr.Or incorrectly describes…