This advisory covers security updates for Red Hat OpenShift Container Platform 4.18.39 and associated golang packages in Red Hat Enterprise Linux 10. The primary security fix is for CVE-2025-61731, which is an arbitrary file write vulnerability in the Go compiler's cmd/go component via a malicious pkg-config directive. Additional fixes include CVE-2026-25679 related to incorrect parsing of IPv6 host literals in net/url. The advisory provides updated container images and RPM packages to address these vulnerabilities and several bug fixes. The update applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64. Detailed upgrade instructions and image digests are provided by Red Hat.

The arbitrary file write vulnerability (CVE-2025-61731) could allow an attacker to write files arbitrarily via the Go compiler, potentially leading to code execution or system compromise if exploited. The incorrect parsing of IPv6 literals (CVE-2026-25679) may cause unexpected behavior in network-related functions. The overall security impact is rated as high by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Red Hat has released updated golang packages and OpenShift Container Platform 4.18.39 container images that fix these vulnerabilities. Users should apply these updates promptly by following the official Red Hat upgrade documentation for OpenShift 4.18 and Red Hat Enterprise Linux 10. The vendor manages remediation for these products through official patches and updated container images. No additional mitigations beyond applying the updates are specified.