MGASA-2026-0035

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0035.html
Import Source
https://advisories.mageia.org/MGASA-2026-0035.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0035
Related
Published
2026-02-11T17:56:31Z
Modified
2026-02-11T18:13:47.296640Z
Summary
Updated golang packages fix security vulnerabilities
Details

net/http: memory exhaustion in Request.ParseForm. (CVE-2025-61726) archive/zip: denial of service when parsing arbitrary ZIP archives. (CVE-2025-61728) crypto/tls: handshake messages may be processed at the incorrect encryption level. (CVE-2025-61730) cmd/go: bypass of flag sanitization can lead to arbitrary code execution. (CVE-2025-61731) Potential code smuggling via doc comments in cmd/cgo. (CVE-2025-61732) cmd/go: unexpected code execution when invoking toolchain. (CVE-2025-68119) crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain. (CVE-2025-68121)

References
Credits

Affected packages

Mageia:9 / golang

Package

Name
golang
Purl
pkg:rpm/mageia/golang?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.24.13-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0035.json"