Summary of Go Security Release: Go 1.25.6 and Go 1.24.12
This text details a security release for the Go programming language, specifically versions 1.25.6 and 1.24.12. Here’s a breakdown of the key vulnerabilities and recommendations:
Key Vulnerabilities:
* TLS Vulnerabilities (affecting session security):
* CVE-2025-68121: Improper session ticket key cloning could allow unauthorized session resumption.
* certificate Validation Issue: Only leaf certificate expiration was checked during session resumption, possibly allowing sessions to remain valid longer than intended with expired intermediate/root certificates.
* CVE-2025-61730: Incorrect encryption level handling during handshakes could expose details to attackers with network-local visibility (e.g., shared networks, corporate environments).
* Arbitrary Code Execution Risks (affecting the toolchain):
* CVE-2025-61731: Unsanitized compiler flags in CgoPkgConfig could allow malicious parameters to be passed to pkg-config, potentially leading to command execution. This is a risk for projects using cgo and system libraries.
* CVE-2025-68119: Arbitrary code execution possible when downloading modules from non-standard sources or building modules with malicious version strings (via Git/Mercurial integration). This impacts developer machines and CI runners.
Impact:
* Denial of Service: Some vulnerabilities could lead to service disruptions.
* Confidentiality & Authentication: TLS vulnerabilities could compromise the security of sessions.
* Code Execution: The toolchain vulnerabilities pose the most serious risk, potentially allowing attackers to execute arbitrary code within build systems.
Recommendations:
* Upgrade Instantly: Organizations are strongly advised to upgrade to Go 1.25.6 or Go 1.24.12 quickly.
* Prioritize Upgrade if:
* You operate internet-facing Go services.
* You process ZIP uploads.
* You accept large URL-encoded form payloads.
* You run build environments that pull dependencies from external sources.
* Consider indirect Impact: Even if you don’t think your directly exposed, you might potentially be impacted through internal integrations or CI systems.
In essence, this release addresses a range of security concerns, with the toolchain vulnerabilities being the most critical due to their potential for remote code execution.Prompt upgrading is crucial to mitigate these risks.
Related reading