This advisory covers three security vulnerabilities in the golang compiler packages for Red Hat Enterprise Linux 9.2. CVE-2025-61728 involves excessive CPU consumption when building archive indexes in the archive/zip package. CVE-2025-61726 concerns memory exhaustion during query parameter parsing in the net/url package. CVE-2025-61732 relates to potential code smuggling via documentation comments in cmd/cgo. These vulnerabilities have been addressed in the golang 1.19.13-23.el9_2 update released by Red Hat. The issues could impact availability and potentially allow code injection under specific conditions.

The vulnerabilities can cause high impact denial of service conditions due to excessive CPU or memory consumption and may allow code smuggling attacks that could lead to code execution risks. The CVSS vector for CVE-2025-61726 indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. Overall, these vulnerabilities affect system stability and security of applications built with the affected golang packages.

Red Hat has released an updated golang package version 1.19.13-23.el9_2 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 should apply this update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official update.