This advisory covers three security vulnerabilities in the golang packages provided by Red Hat Enterprise Linux 9.2. CVE-2025-61728 involves excessive CPU consumption when building an archive index in the archive/zip package. CVE-2025-61726 is a memory exhaustion vulnerability in query parameter parsing within the net/url package. CVE-2025-61732 concerns potential code smuggling via documentation comments in the cmd/cgo tool. Red Hat has released updated golang packages (version 1.19.13-23.el9_2) that address these issues. The advisory applies to multiple architectures including x86_64, ppc64le, aarch64, and s390x. The update is classified as Important and users are advised to apply it promptly.

The vulnerabilities can lead to resource exhaustion such as excessive CPU usage and memory exhaustion, potentially impacting system stability or availability when processing specially crafted inputs. The code smuggling vulnerability in cmd/cgo could allow unintended code execution or manipulation via doc comments. These issues affect the golang compiler and related tools, which may be used in development or build environments. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for golang packages in Red Hat Enterprise Linux 9.2 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:3472 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated by the vendor beyond applying the update.