Go 1.25.7 and 1.24.13 Released to Patch Multiple Security Vulnerabilities

The Go development team has rolled out new point releases Go 1.25.7 and Go 1.24.13 addressing two critical security flaws in the cmd/cgo and crypto/tls components.

These updates are strongly recommended for all users, as the vulnerabilities could lead to code smuggling or authentication bypass in certain configurations.

Overview of Vulnerabilities

The first issue, discovered by RyotaK of GMO Flatt Security Inc., affects Go’s cmd/cgo tool that allows Go code to interact with C code.

The vulnerability arises from differences in comment parsing behavior between Go’s compiler and C/C++ compilers.

Attackers could exploit these discrepancies to insert malicious instructions within comment blocks effectively smuggling executable code into the resulting binaries without detection.

In practical terms, a developer might believe certain code lines are safely commented out, while the C compiler interprets them as active instructions.

The fix ensures that user-provided documentation comments are no longer parsed during Abstract Syntax Tree (AST) processing, eliminating the potential for hidden payloads.

The second vulnerability, reported by Coia Prant, impacts session resumption in the crypto/tls package. The flaw occurs when using Config.GetConfigForClient, which reuses session ticket keys from a parent configuration unless explicitly overridden.

If a server modifies authentication parameters, such as updating its ClientCAs a previously established session could still resume using the old parameters.

This mismatch creates an authentication bypass scenario, where a client might reconnect without satisfying stricter new verification rules.

To address this, Go’s updated TLS logic now cross-verifies that the root of the validated certificate chain remains trusted (present in either ClientCAs or RootCAs) before allowing session resumption.

This safeguard applies when ClientAuth is configured to VerifyClientCertIfGiven or RequireAndVerifyClientCert.

The fixes have been incorporated into Go 1.25.7 and Go 1.24.13. Developers are advised to update promptly, as both vulnerabilities could lead to unauthorized code execution or skipped authentication in production environments.

CVE ID	Component	Severity / Type	Description
CVE-2025-61732	cmd/cgo	Code Injection	Discrepancy in comment parsing between Go and C/C++ allows code smuggling within cgo binaries.
CVE-2025-68121	crypto/tls	Auth Bypass	Session resumption via GetConfigForClient may bypass updated authentication parameters (e.g., ClientCAs).

The Go team continues to emphasize the importance of staying current with patch releases, particularly for environments running security-sensitive or network-facing applications.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.