Go 1.25.6 and 1.24.12 Patch Critical Vulnerabilities Lead to DoS and Memory Exhaustion Risks
The Go programming language team has released emergency updates, Go 1.25.6 and 1.24.12, to address six significant security vulnerabilities.
The Go programming language team has released emergency updates, Go 1.25.6 and 1.24.12, to address six significant security vulnerabilities.
These updates resolve issues related to denial-of-service (DoS) vectors, arbitrary code execution risks, and TLS mishandlings that could make developers susceptible to remote attacks.
Although not labeled as version 1.26, these patches require immediate implementation, especially in projects using Go’s standard library, including web servers, cryptographic tools, and build systems.
The updates have been announced through official channels and align with Go's strict security policy, acknowledging external researchers for their contributions.
Binary downloads are accessible at go.dev/dl , with comprehensive notes available at go.dev/doc/devel/release#go1.25.6 . Unpatched environments remain vulnerable to exploitation from ZIP parsers to TLS handshakes.
The updates include significant fixes such as net/http's Request.ParseForm, which previously allowed memory exhaustion through malicious URL-encoded forms with excessive key-value pairs, potentially crippling servers under load. Additionally, archive/zip's super-linear filename indexing posed a DoS risk through specially crafted archives.
More critical vulnerabilities include cmd/go flaws that enable code execution. CgoPkgConfig bypassed flag sanitization, allowing pkg-config to run with unsafe inputs. Toolchain VCS handling for Git/Mercurial permitted code execution or file overwriting through malicious module versions or domains, although not through the @latest path.
The Go programming language team has released emergency updates, Go 1.25.6 and 1.24.12, to address six significant security vulnerabilities.
TLS-related issues exacerbate these risks: Config.Clone leaked session ticket keys, enabling unauthorized resumptions across configurations. Furthermore, session checks did not consider full certificate chain expirations, and handshake messages processed at incorrect encryption levels risked information leaks from injected packets.
CVE ID Component Description Summary Go Issue Link Reporter
CVE-2025-61728 archive/zip Super-linear filename indexing causes DoS on malicious ZIPs go.dev/issue/77102 Jakub Ciolek
CVE-2025-61726 net/http Memory exhaustion from excessive form key-value pairs go.dev/issue/77101 jub0bs
CVE-2025-68121 crypto/tls Config.Clone leaks session keys; ignores full cert chain expiration go.dev/issue/77113 Coia Prant (rbqvq)
CVE-2025-61731 cmd/go CgoPkgConfig flag bypass leads to arbitrary code execution go.dev/issue/77100 RyotaK (GMO Flatt Security)
CVE-2025-68119 cmd/go VCS toolchain misinterpretation enables code exec/file writes go.dev/issue/77099 splitline (DEVCORE)
CVE-2025-61730 crypto/tls Handshake messages processed at incorrect encryption level (info disclosure) go.dev/issue/76443 Coia Prant (rbqvq)
Developers are advised to upgrade to version 1.25.6 or 1.24.12 immediately and rebuild binaries using git checkout go1.25.6 . It is crucial to scan dependencies for vulnerable modules.
While official CVSS scores have not been published yet, the potential for DoS and RCE is significant. Go's proactive patching emphasizes the importance of supply-chain security in 2026's threat landscape.
Based on reporting by Cyber Security News.