The golang packages for Red Hat Enterprise Linux 9.2 contain two security vulnerabilities. CVE-2025-61731 allows arbitrary file writes through a malicious pkg-config directive in the cmd/go tool, which could lead to unauthorized file modifications. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package, potentially causing incorrect behavior in applications relying on this parsing. Red Hat has issued updated golang packages that address these vulnerabilities. The advisory references Red Hat's errata RHSA-2026:7833 and provides updated package versions for multiple architectures and variants of Red Hat Enterprise Linux 9.2.

Successful exploitation of CVE-2025-61731 could allow an attacker to write arbitrary files via a crafted pkg-config directive, potentially leading to unauthorized code execution or system compromise depending on the context. CVE-2026-25679 could cause applications to incorrectly parse IPv6 host literals, which may lead to unexpected application behavior or security issues related to URL handling. The overall impact is rated as important by Red Hat, indicating a high severity but not critical. There are no known exploits in the wild currently.

Red Hat has released updated golang packages for Red Hat Enterprise Linux 9.2 that fix these vulnerabilities. Users should apply the official updates as described in Red Hat advisory RHSA-2026:7833 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. Since this is not a cloud service, remediation depends on user action to update affected systems. Patch status is confirmed by the vendor advisory.