The Red Hat security advisory RHSA-2026:3468 reports two vulnerabilities in the Go Toolset for Red Hat Enterprise Linux 8.2. CVE-2025-61726 is a memory exhaustion vulnerability in the net/url package's query parameter parsing, which could lead to resource exhaustion. CVE-2025-61732 is a potential code smuggling vulnerability via doc comments in the cmd/cgo tool, which could allow unintended code execution or manipulation. Red Hat has issued an important security update addressing these vulnerabilities. The advisory references updated packages for go-toolset and golang components. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat. The update is specifically for the go-toolset:rhel8 module on Red Hat Enterprise Linux 8.2 AUS.

The memory exhaustion vulnerability in net/url (CVE-2025-61726) could allow an attacker to cause denial of service by exhausting system memory during query parameter parsing. The code smuggling vulnerability in cmd/cgo (CVE-2025-61732) could potentially allow an attacker to inject or execute unintended code via specially crafted documentation comments. Both vulnerabilities impact the Go Toolset used in Red Hat Enterprise Linux 8.2, potentially affecting applications built or run with these tools. The advisory rates the overall impact as important, indicating a significant security risk if unpatched.

Red Hat has released an updated go-toolset:rhel8 module for Red Hat Enterprise Linux 8.2 AUS that addresses these vulnerabilities. Users should apply this official security update as described in Red Hat advisory RHSA-2026:3468 and the referenced article https://access.redhat.com/articles/11258. Applying the update will remediate the memory exhaustion and code smuggling issues. No additional mitigation steps are indicated or required beyond applying the vendor-provided update.