CVE-2025-61732
Vulnerability Summary
Timeline
Description
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVSS Metrics
- v3.1•HIGH•Score: 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.48%• Percentile: 41%
Techniques & Countermeasures
- CWE-94•Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected Systems
- chainguard•aactl
< 0.4.12-r40
- chainguard•actions-runner-controller
< 0.13.1-r2
- chainguard•actions-runner-controller-fips
< 0.13.1-r3
- chainguard•addon-resizer
< 1.8.23-r13
- chainguard•addon-resizer-fips
< 1.8.23-r15
- chainguard•age
< 1.3.1-r2
- chainguard•age-fips
< 1.3.1-r2
- chainguard•agentbeat
< 9.2.4-r2
- chainguard•agentbeat-fips
< 9.2.4-r2
- chainguard•amass
< 5.0.1-r6
- chainguard•amazon-cloudwatch-agent-operator
< 3.3.1-r2
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.3.1-r3
- chainguard•amazon-ecs-agent
< 1.101.3-r0
- chainguard•amazon-ecs-agent-fips
< 1.101.3-r0
- chainguard•amazon-ecs-cni-plugins
< 2024.9.0_git20260129-r2
- chainguard•amazon-ecs-cni-plugins-fips
< 2024.9.0_git20260129-r4
- chainguard•amazon-eks-ami
< 20260129-r2
- chainguard•amazon-eks-ami-fips
< 20260129-r1
- chainguard•amazon-k8s-cni
< 1.21.1-r4
- chainguard•amazon-k8s-cni-fips
< 1.21.1-r4
- chainguard•amazon-k8s-cni-init
< 1.21.1-r4
- chainguard•amazon-k8s-cni-init-fips
< 1.21.1-r4
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.21.1-r5
- chainguard•amazon-ssm-agent
< 3.3.3270.0-r5
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.3270.0-r5
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 3.3.3270.0-r5
- chainguard•amazon-vpc-cni-plugins
< 1.3_git20251112-r5
- chainguard•amazon-vpc-cni-plugins-fips
< 1.3_git20251112-r6
- chainguard•ansible-operator
< 1.42.0-r7
- chainguard•ansible-operator-fips
< 1.42.0-r5
- chainguard•apache-beam-java-11-sdk
< 2.71.0-r2
- chainguard•apache-beam-java-17-sdk
< 2.71.0-r2
- chainguard•apache-beam-java-21-sdk
< 2.71.0-r2
- chainguard•apache-exporter
< 1.0.12-r2
- chainguard•apisix-ingress-controller
< 2.0.1-r4
- chainguard•apm-server-7.17
< 7.17.29-r10
- chainguard•apm-server-8.17
< 8.17.10-r5
- chainguard•apm-server-8.19
< 8.19.11-r1
- chainguard•apm-server-9.0
< 9.0.8-r3
- chainguard•apm-server-9.1
< 9.1.10-r1
- chainguard•apm-server-9.2
< 9.2.5-r1
- chainguard•apm-server-fips-7.17
< 7.17.29-r9
- chainguard•apm-server-fips-8.19
< 8.19.11-r1
- chainguard•apm-server-fips-9.0
< 9.0.8-r4
- chainguard•apm-server-fips-9.1
< 9.1.10-r1
- chainguard•apm-server-fips-9.2
< 9.2.5-r1
- chainguard•argo-cd-2.13
< 2.13.9-r8
- chainguard•argo-cd-2.13-compat
< 2.13.9-r8
- chainguard•argo-cd-2.14
< 2.14.21-r7
- chainguard•argo-cd-2.14-compat
< 2.14.21-r7
Showing first 50 affected entries in server-rendered view.
References (44)
- https://go.dev/cl/734220
- https://go.dev/issue/76697
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
- https://pkg.go.dev/vuln/GO-2026-4433
- https://access.redhat.com/security/cve/CVE-2025-61732
- https://bugzilla.redhat.com/show_bug.cgi?id=2437016
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.json
- https://access.redhat.com/errata/RHSA-2026:3192
- https://access.redhat.com/errata/RHSA-2026:2706
- https://access.redhat.com/errata/RHSA-2026:2708
- https://access.redhat.com/errata/RHSA-2026:3468
- https://access.redhat.com/errata/RHSA-2026:3470
- https://access.redhat.com/errata/RHSA-2026:3489
- https://access.redhat.com/errata/RHSA-2026:3471
- https://access.redhat.com/errata/RHSA-2026:3473
- https://access.redhat.com/errata/RHSA-2026:3472
- https://access.redhat.com/errata/RHSA-2026:3469
- https://access.redhat.com/errata/RHSA-2026:3193
- https://access.redhat.com/errata/RHSA-2026:2709
- https://access.redhat.com/errata/RHSA-2026:7385
- https://access.redhat.com/errata/RHSA-2026:7291
- https://access.redhat.com/errata/RHSA-2026:12282
- https://access.redhat.com/errata/RHSA-2026:14100
- https://access.redhat.com/errata/RHSA-2026:21691
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:10104
- https://access.redhat.com/errata/RHSA-2026:5907
- https://access.redhat.com/errata/RHSA-2026:8448
- https://access.redhat.com/errata/RHSA-2026:5133
- https://access.redhat.com/errata/RHSA-2026:4434
- https://access.redhat.com/errata/RHSA-2026:3855
- https://access.redhat.com/errata/RHSA-2026:2844
- https://access.redhat.com/errata/RHSA-2026:3559
- https://access.redhat.com/errata/RHSA-2026:3556
- https://access.redhat.com/errata/RHSA-2026:5948
- https://access.redhat.com/errata/RHSA-2026:5950
- https://access.redhat.com/errata/RHSA-2026:5952
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:5878
- https://security-tracker.debian.org/tracker/CVE-2025-61732
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61732.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-61732