Red Hat Product Security released an advisory (RHSA-2026:3471) for the go-toolset module in Red Hat Enterprise Linux 8.8, addressing three vulnerabilities in the golang components. CVE-2025-61726 involves memory exhaustion in the net/url package during query parameter parsing. CVE-2025-61728 concerns excessive CPU consumption when building archive indexes in the archive/zip package. CVE-2025-61732 relates to potential code smuggling via doc comments in cmd/cgo. These vulnerabilities could impact system stability or security when processing specially crafted inputs. Red Hat has provided updated packages to fix these issues, and detailed patch instructions are available in their advisory.

The vulnerabilities can lead to resource exhaustion conditions such as excessive CPU usage and memory exhaustion, potentially causing denial of service or degraded performance in applications using the affected Go libraries. The code smuggling vulnerability may allow unintended code execution paths via documentation comments, posing a risk of malicious code injection or execution. However, no known exploits in the wild have been reported. The overall impact is rated as Important by Red Hat.

Red Hat has released updated go-toolset packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:3471 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigations are specified or required beyond installing the updates.