This advisory covers three security fixes in the Go Toolset provided by Red Hat for RHEL 8.6. CVE-2025-61728 addresses excessive CPU consumption during archive index building in the archive/zip package. CVE-2025-61726 involves memory exhaustion caused by query parameter parsing in the net/url package. CVE-2025-61732 concerns potential code smuggling through doc comments in the cmd/cgo tool. These vulnerabilities affect the Go programming language tools and libraries included in the go-toolset module. Red Hat has released updated packages to fix these issues in RHEL 8.6 variants including Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory does not provide CVSS scores but classifies the impact as important.

The vulnerabilities can lead to resource exhaustion such as excessive CPU usage and memory exhaustion, potentially impacting system stability or availability when processing crafted inputs. The code smuggling issue in cmd/cgo could allow unintended code execution paths via doc comments. These issues affect the Go toolset components used in software development and runtime environments on Red Hat Enterprise Linux 8.6. No known exploits in the wild have been reported at this time.

Red Hat has released updated go-toolset packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available in the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the vendor-provided patches.