Alpine: multiple go packages: security update to 1.25.6-r0

critical Tenable Self-Hosted Container Security Plugin ID 436784

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields
mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it
should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or
uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would
not have resumed with during the initial handshake, or cause a server to resume a session with a client
that it would not have resumed with during the initial handshake. (CVE-2025-68121)

- The net/url package does not set a limit on the number of query parameters in a query. While the maximum
size of query parameters in URLs is generally limited by the maximum request header size, the
net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many
unique query parameters can cause excessive memory consumption. (CVE-2025-61726)

- archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an
archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP
archive. (CVE-2025-61728)

- During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level
boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may
be processed before the encryption level changes. This can cause some minor information disclosure if a
network-local attacker can inject messages during the handshake. (CVE-2025-61730)

- Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with
partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides
command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file"
argument to this directive, causing pkg-config to write to an attacker-controlled location.
(CVE-2025-61731)

Plugin Details

Severity: Critical

ID: 436784

Version: Revision 1.10

Type: Local

Family: Alpine Linux Local Security Checks

Published: 1/16/2026

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-68121

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

CVE: CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-68119, CVE-2025-68121

Detections

Analytics