The golang packages in Red Hat Enterprise Linux 9.2 contain three security vulnerabilities: CVE-2025-61728 causes excessive CPU consumption when building archive indexes in the archive/zip package; CVE-2025-61726 leads to memory exhaustion during query parameter parsing in the net/url package; and CVE-2025-61732 involves potential code smuggling via documentation comments in cmd/cgo. These issues can impact system stability and security by exhausting resources or enabling unexpected code behavior. Red Hat has issued updated golang packages to fix these vulnerabilities as detailed in advisory RHSA-2026:3472.

The vulnerabilities can cause denial of service conditions through excessive CPU or memory consumption and may allow unexpected code execution paths via code smuggling. These impacts could degrade system performance or reliability. No evidence of active exploitation is reported. The issues affect systems running the affected golang packages on Red Hat Enterprise Linux 9.2 and related distributions.

Red Hat has released updated golang packages that address these vulnerabilities. Users should apply the security update for golang as described in Red Hat advisory RHSA-2026:3472 and the related article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigations are indicated by the vendor advisory.