CVE-2025-61732
High · 8.6CVSS
8.6
EPSS
0.5%
Published
Feb 5, 2026
CISA due date
—
The record
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | toolchain | 0 | 1.24.13 |
| Chainguard | aactl | 0 | 0.4.12-r40 |
| Chainguard | actions-runner-controller | 0 | 0.13.1-r2 |
| Chainguard | actions-runner-controller-fips | 0 | 0.13.1-r3 |
| Chainguard | addon-resizer | 0 | 1.8.23-r13 |
| Chainguard | addon-resizer-fips | 0 | 1.8.23-r15 |
| Chainguard | age | 0 | 1.3.1-r2 |
| Chainguard | age-fips | 0 | 1.3.1-r2 |
| Chainguard | agentbeat | 0 | 9.2.4-r2 |
| Chainguard | agentbeat-fips | 0 | 9.2.4-r2 |
| Chainguard | amass | 0 | 5.0.1-r6 |
| Chainguard | amazon-cloudwatch-agent-operator | 0 | 3.3.1-r2 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 0 | 3.3.1-r3 |
| Chainguard | amazon-ecs-agent | 0 | 1.101.3-r0 |
| Chainguard | amazon-ecs-agent-fips | 0 | 1.101.3-r0 |
| Chainguard | amazon-ecs-cni-plugins | 0 | 2024.9.0_git20260129-r2 |
| Chainguard | amazon-ecs-cni-plugins-fips | 0 | 2024.9.0_git20260129-r4 |
| Chainguard | amazon-eks-ami | 0 | 20260129-r2 |
| Chainguard | amazon-eks-ami-fips | 0 | 20260129-r1 |
| Chainguard | amazon-k8s-cni | 0 | 1.21.1-r4 |
| Chainguard | amazon-k8s-cni-fips | 0 | 1.21.1-r4 |
| Chainguard | amazon-k8s-cni-init | 0 | 1.21.1-r4 |
| Chainguard | amazon-k8s-cni-init-fips | 0 | 1.21.1-r4 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 1.21.1-r5 |
| Chainguard | amazon-ssm-agent | 0 | 3.3.3270.0-r5 |
| Chainguard | amazon-ssm-agent-ecs-exec | 0 | 3.3.3270.0-r5 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r5 |
| Chainguard | amazon-vpc-cni-plugins | 0 | 1.3_git20251112-r5 |
| Chainguard | amazon-vpc-cni-plugins-fips | 0 | 1.3_git20251112-r6 |
| Chainguard | ansible-operator | 0 | 1.42.0-r7 |
| Chainguard | ansible-operator-fips | 0 | 1.42.0-r5 |
| Chainguard | apache-beam-java-11-sdk | 0 | 2.71.0-r2 |
| Chainguard | apache-beam-java-17-sdk | 0 | 2.71.0-r2 |
| Chainguard | apache-beam-java-21-sdk | 0 | 2.71.0-r2 |
| Chainguard | apache-exporter | 0 | 1.0.12-r2 |
| Chainguard | apisix-ingress-controller | 0 | 2.0.1-r4 |
| Chainguard | apm-server-7.17 | 0 | 7.17.29-r10 |
| Chainguard | apm-server-8.17 | 0 | 8.17.10-r5 |
| Chainguard | apm-server-8.19 | 0 | 8.19.11-r1 |
| Chainguard | apm-server-9.0 | 0 | 9.0.8-r3 |
| Chainguard | apm-server-9.1 | 0 | 9.1.10-r1 |
| Chainguard | apm-server-9.2 | 0 | 9.2.5-r1 |
| Chainguard | apm-server-fips-7.17 | 0 | 7.17.29-r9 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.11-r1 |
| Chainguard | apm-server-fips-9.0 | 0 | 9.0.8-r4 |
| Chainguard | apm-server-fips-9.1 | 0 | 9.1.10-r1 |
| Chainguard | apm-server-fips-9.2 | 0 | 9.2.5-r1 |
| Chainguard | argo-cd-2.13 | 0 | 2.13.9-r8 |
| Chainguard | argo-cd-2.13-compat | 0 | 2.13.9-r8 |
| Chainguard | argo-cd-2.14 | 0 | 2.14.21-r7 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r7 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r1 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r1 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.6-r1 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.6-r1 |
| Chainguard | argo-cd-fips-2.14 | 0 | 2.14.21-r7 |
| Chainguard | argo-cd-fips-2.14-compat | 0 | 2.14.21-r7 |
| Chainguard | argo-cd-fips-3.0 | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-fips-3.0-compat | 0 | 3.0.23-r2 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.12-r2 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.6-r2 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.6-r2 |
| Chainguard | argo-events | 0 | 1.9.10-r2 |
| Chainguard | argo-events-fips | 0 | 1.9.10-r2 |
| Chainguard | argo-rollouts | 0 | 1.8.3-r8 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.3-r9 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 3.6.18-r2 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.9-r1 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.18-r2 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.9-r1 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.18-r2 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.9-r1 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.0-r1 |
| Chainguard | atlantis | 0 | 0.40.0-r1 |
| Chainguard | atlantis-fips | 0 | 0.40.0-r2 |
| Chainguard | auditbeat-7 | 0 | 7.17.29-r9 |
| Chainguard | auditbeat-8.17 | 0 | 8.17.10-r7 |
| Chainguard | auditbeat-8.18 | 0 | 8.18.8-r8 |
| Chainguard | auditbeat-9.0 | 0 | 9.0.8-r6 |
| Chainguard | auditbeat-9.1 | 0 | 9.1.10-r2 |
| Chainguard | auditbeat-9.2 | 0 | 9.2.5-r0 |
| Chainguard | auditbeat-fips-7 | 0 | 7.17.29-r9 |
| Chainguard | auditbeat-fips-8.17 | 0 | 8.17.10-r5 |
| Chainguard | auditbeat-fips-8.18 | 0 | 8.18.8-r5 |
| Chainguard | auditbeat-fips-8.19 | 0 | 8.19.11-r0 |
| Chainguard | auditbeat-fips-9.0 | 0 | 9.0.8-r5 |
| Chainguard | auditbeat-fips-9.1 | 0 | 9.1.10-r2 |
| Chainguard | auditbeat-fips-9.2 | 0 | 9.2.5-r0 |
| Chainguard | authentik-go-server-fips | 0 | 2025.12.1-r3 |
| Chainguard | authservice | 0 | 1.1.5-r3 |
| Chainguard | authservice-fips | 0 | 1.1.5-r2 |
| Chainguard | aws-application-networking-k8s | 0 | 2.0.0-r2 |
| Chainguard | aws-application-networking-k8s-fips | 0 | 2.0.0-r2 |
| Chainguard | aws-ebs-csi-driver-1.49 | 0 | 1.49.2-r3 |
| Chainguard | aws-ebs-csi-driver-1.50 | 0 | 1.50.3-r3 |
| Chainguard | aws-ebs-csi-driver-1.51 | 0 | 1.51.2-r3 |
| Chainguard | aws-ebs-csi-driver-1.52 | 0 | 1.52.1-r4 |
| Chainguard | aws-ebs-csi-driver-1.53 | 0 | 1.53.0-r3 |
| Chainguard | aws-ebs-csi-driver-1.54 | 0 | 1.54.0-r3 |
| Chainguard | aws-ebs-csi-driver-1.55 | 0 | 1.55.0-r1 |
| Chainguard | aws-ebs-csi-driver-fips-1.49 | 0 | 1.49.2-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 1.50.3-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.51 | 0 | 1.51.2-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.52 | 0 | 1.52.1-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.53 | 0 | 1.53.0-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.54 | 0 | 1.54.0-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.55 | 0 | 1.55.0-r1 |
| Chainguard | aws-efs-csi-driver | 0 | 2.3.0-r2 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 2.3.0-r2 |
| Chainguard | aws-eks-pod-identity-agent | 0 | 0.1.36-r5 |
| Chainguard | aws-eks-pod-identity-agent-fips | 0 | 0.1.36-r3 |
| Chainguard | aws-flb-cloudwatch | 0 | 1.9.4-r25 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r20 |
| Chainguard | aws-flb-firehose | 0 | 1.7.2-r24 |
| Chainguard | aws-flb-firehose-fips | 0 | 1.7.2-r19 |
| Chainguard | aws-flb-kinesis | 0 | 1.10.3-r6 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.3-r7 |
| Chainguard | aws-fsx-csi-driver | 0 | 1.8.0-r2 |
| Chainguard | aws-fsx-csi-driver-fips | 0 | 1.8.0-r2 |
| Chainguard | aws-iam-authenticator | 0 | 0.7.10-r3 |
| Chainguard | aws-iam-authenticator-fips | 0 | 0.7.10-r2 |
| Chainguard | aws-load-balancer-controller | 0 | 3.0.0-r1 |
| Chainguard | aws-load-balancer-controller-fips | 0 | 3.0.0-r2 |
| Chainguard | aws-network-policy-agent | 0 | 1.3.1-r2 |
| Chainguard | aws-network-policy-agent-fips | 0 | 1.3.1-r2 |
| Chainguard | aws-node-termination-handler | 0 | 1.25.4-r2 |
| Chainguard | aws-node-termination-handler-fips | 0 | 1.25.4-r1 |
| Chainguard | aws-otel-collector-fips | 0 | 0.47.0-r1 |
| Chainguard | aws-otel-collector-healthcheck | 0 | 0.47.0-r1 |
| Chainguard | aws-otel-collector-healthcheck-fips | 0 | 0.47.0-r1 |
| Chainguard | aws-privateca-issuer | 0 | 1.8.0-r4 |
| Chainguard | aws-privateca-issuer-fips | 0 | 1.8.0-r3 |
| Chainguard | aws-s3-controller | 0 | 1.3.0-r1 |
| Chainguard | aws-signer-notation-plugin | 0 | 1.0.2292-r8 |
| Chainguard | aws-signer-notation-plugin-fips | 0 | 1.0.2292-r6 |
| Chainguard | aws-sigv4-proxy | 0 | 1.11-r3 |
| Chainguard | aws-sigv4-proxy-fips | 0 | 1.11-r2 |
| Chainguard | azcopy | 0 | 10.32.0-r1 |
| Chainguard | azcopy-fips | 0 | 10.32.0-r1 |
| Chainguard | azure-aad-pod-identity-mic | 0 | 1.8.17-r33 |
| Chainguard | azure-aad-pod-identity-nmi | 0 | 1.8.17-r33 |
| Chainguard | azure-ipam | 0 | 0.4.0-r10 |
| Chainguard | azure-service-operator | 0 | 2.17.0-r2 |
| Chainguard | azure-service-operator-fips | 0 | 2.17.0-r2 |
| Chainguard | azure-vnet-cni | 0 | 1.7.12-r2 |
| Chainguard | azure-workload-identity-webhook | 0 | 1.5.1-r7 |
| Chainguard | azuredisk-csi-1.28 | 0 | 1.28.12-r14 |
| Chainguard | azuredisk-csi-1.29 | 0 | 1.29.14-r13 |
| Chainguard | azuredisk-csi-1.30 | 0 | 1.30.12-r11 |
| Chainguard | azuredisk-csi-1.31 | 0 | 1.31.12-r7 |
| Chainguard | azuredisk-csi-1.32 | 0 | 1.32.12-r1 |
| Chainguard | azuredisk-csi-1.33 | 0 | 1.33.8-r2 |
| Chainguard | azuredisk-csi-1.34 | 0 | 1.34.1-r1 |
| Chainguard | azuredisk-csi-fips-1.28 | 0 | 1.28.12-r12 |
| Chainguard | azuredisk-csi-fips-1.29 | 0 | 1.29.14-r12 |
| Chainguard | azuredisk-csi-fips-1.30 | 0 | 1.30.12-r10 |
| Chainguard | azuredisk-csi-fips-1.31 | 0 | 1.31.12-r7 |
| Chainguard | azuredisk-csi-fips-1.32 | 0 | 1.32.12-r1 |
| Chainguard | azuredisk-csi-fips-1.33 | 0 | 1.33.8-r2 |
| Chainguard | azuredisk-csi-fips-1.34 | 0 | 1.34.1-r1 |
| Chainguard | azurefile-csi-1.29 | 0 | 1.29.12-r11 |
| Chainguard | azurefile-csi-1.30 | 0 | 1.30.10-r11 |
| Chainguard | azurefile-csi-1.31 | 0 | 1.31.8-r7 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.9-r3 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.7-r2 |
| Chainguard | azurefile-csi-fips-1.29 | 0 | 1.29.12-r11 |
| Chainguard | azurefile-csi-fips-1.30 | 0 | 1.30.10-r11 |
| Chainguard | azurefile-csi-fips-1.31 | 0 | 1.31.8-r7 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.9-r2 |
| Chainguard | azurefile-csi-fips-1.33 | 0 | 1.33.7-r2 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.3-r2 |
| Chainguard | backup-restore-operator-7.0 | 0 | 7.0.5-r1 |
| Chainguard | backup-restore-operator-8.1 | 0 | 8.1.2-r1 |
| Chainguard | backup-restore-operator-9.0 | 0 | 9.0.1-r1 |
| Chainguard | backup-restore-operator-fips-7.0 | 0 | 7.0.5-r1 |
| Chainguard | backup-restore-operator-fips-8.1 | 0 | 8.1.2-r1 |
| Chainguard | backup-restore-operator-fips-9.0 | 0 | 9.0.1-r1 |
| Chainguard | bank-vaults | 0 | 1.32.1-r2 |
| Chainguard | bank-vaults-fips | 0 | 1.20.4-r38 |
| Chainguard | bank-vaults-template | 0 | 1.32.1-r2 |
| Chainguard | bank-vaults-template-fips | 0 | 1.20.4-r38 |
| Chainguard | bazelisk | 0 | 1.28.1-r1 |
| Chainguard | blob-csi-1.23 | 0 | 1.23.11-r64 |
| Chainguard | blob-csi-1.24 | 0 | 1.24.11-r13 |
| Chainguard | blob-csi-1.25 | 0 | 1.25.10-r9 |
| Chainguard | blob-csi-1.26 | 0 | 1.26.9-r2 |
| Chainguard | blob-csi-1.27 | 0 | 1.27.2-r1 |
| Chainguard | blob-csi-fips-1.23 | 0 | 1.23.11-r65 |
| Chainguard | blob-csi-fips-1.24 | 0 | 1.24.11-r13 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r8 |
| Chainguard | blob-csi-fips-1.26 | 0 | 1.26.9-r1 |
| Chainguard | blob-csi-fips-1.27 | 0 | 1.27.2-r1 |
| Chainguard | blobfuse2-fips | 0 | 2.4.2-r10 |
| Chainguard | blobfuse2-fips-health-monitor | 0 | 2.4.2-r10 |
| Chainguard | blobfuse2-health-monitor | 0 | 2.4.2-r9 |
| Chainguard | bom | 0 | 0.7.1-r5 |
| Chainguard | boring-registry | 0 | 0.16.6-r7 |
Related vulnerabilities
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects toolchain
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects toolchain
- CVE-2023-24531 Command go env is documented as outputting a shell script containing the Go environment. Also affects toolchain
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects aactl
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects aactl
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects aactl
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects aactl
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aactl