Security update for go1.24-openssl
Description
This security update for go1.24-openssl addresses multiple critical vulnerabilities affecting various components such as crypto/tls, net/mail, crypto/x509, encoding/asn1, net/http, archive/tar, net/url, archive/zip, and cmd/go. The issues include memory exhaustion, excessive CPU consumption, denial of service, panic conditions, information leakage, and potential arbitrary code execution. The update fixes these vulnerabilities in version 1.24.13 of go1.24-openssl.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The go1.24-openssl update to version 1.24.13 fixes numerous security issues including CVE-2025-58189 (ALPN negotiation error leaking attacker-controlled information), CVE-2025-61725 (excessive CPU consumption in net/mail ParseAddress), CVE-2025-58188 (panic in crypto/x509 with DSA keys), CVE-2025-58185 and CVE-2025-58186 (memory exhaustion in ASN.1 parsing and HTTP cookie parsing), CVE-2025-61723 (quadratic complexity in PEM parsing), CVE-2025-58183 (unbounded allocation in archive/tar), CVE-2025-47912 (insufficient validation of IPv6 hostnames in net/url), CVE-2025-58187 (quadratic complexity in name constraints checking), CVE-2025-61724 (excessive CPU in net/textproto), CVE-2025-61729 and CVE-2025-61727 (issues in crypto/x509), CVE-2025-61730 (incorrect encryption level processing in TLS handshake), CVE-2025-61731 and CVE-2025-61732 (arbitrary code execution and code smuggling in cmd/go), CVE-2025-61726 (memory exhaustion in HTTP form parsing), CVE-2025-61728 (denial of service in archive/zip), CVE-2025-68121 (session ticket key handling in TLS), and CVE-2025-68119 (unexpected code execution in cmd/go). These vulnerabilities collectively pose risks including denial of service, information leakage, and code execution.
Potential Impact
The vulnerabilities fixed in this update can lead to critical impacts such as denial of service via memory exhaustion or excessive CPU consumption, information disclosure through attacker-controlled data leakage, panic conditions causing service disruption, and potential arbitrary code execution. These issues affect core components of the Go language's cryptographic, networking, and archive handling libraries, which could compromise the security and stability of applications relying on go1.24-openssl.
Mitigation Recommendations
A security update is available that fixes all the listed vulnerabilities in go1.24-openssl version 1.24.13. Users and administrators should apply this update promptly to mitigate the risks. No additional vendor advisories indicate that no action is required or that these issues are already mitigated by other means.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2025-47912
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a998f65acd9273b49193476
Added to database: 09/03/2026, 15:16:53 UTC
Last enriched: 09/17/2026, 03:29:42 UTC
Last updated: 10/10/2026, 06:48:13 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.