This advisory covers a security update for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9 that addresses multiple vulnerabilities in Go language components including gRPC-Go, net/mail, MIME, encoding/asn1, crypto/tls, html/template, net/http, XML decoding, net/url, and OpenTelemetry-Go. The vulnerabilities primarily allow denial-of-service attacks through malformed or malicious inputs, and one XSS vulnerability via pathological input. The update includes patched RPM packages for golang1.25 and related components. The vendor advisory confirms the availability of patches and provides detailed package versions for remediation.

The vulnerabilities allow attackers to cause denial-of-service conditions in affected components by sending malformed or maliciously crafted inputs, potentially disrupting service availability. One vulnerability allows cross-site scripting (XSS) via pathological input. There are no reports of known exploits in the wild. The impact is primarily service disruption and potential security bypass in template rendering.

A security update is available and should be applied promptly. Red Hat has released patched versions of golang1.25 packages (version 1.25.13-0.1.hum1) that address these vulnerabilities. Users should update to these versions as per Red Hat's advisory instructions. No additional mitigation steps are indicated by the vendor.