The Red Hat go-toolset:rhel8 security update fixes two vulnerabilities: CVE-2025-61731, which allows arbitrary file write through a malicious pkg-config directive in the cmd/go tool, and CVE-2026-25679, which involves incorrect parsing of IPv6 host literals in the net/url package. These vulnerabilities affect versions of the go-toolset module in Red Hat Enterprise Linux 8 from 1.25.2 up to but not including 1.25.8. The advisory references updated packages that address these issues. No known exploits in the wild have been reported. The update is classified as Important by Red Hat, indicating a high security impact but not critical.

The arbitrary file write vulnerability (CVE-2025-61731) could allow an attacker to write files arbitrarily via a crafted pkg-config directive, potentially leading to code execution or system compromise if exploited. The incorrect parsing of IPv6 host literals (CVE-2026-25679) could lead to incorrect handling of network addresses, which might affect network-related functionality or security. The exact impact depends on the usage context of the affected components. No active exploitation has been reported.

Red Hat has released updated go-toolset packages for Red Hat Enterprise Linux 8 that fix these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2026:6949 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.