Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: go fixed in 1.24.5-r0
AnalysisAI
Go language runtime or toolchain package on Alpine Linux contains a vulnerability addressed in the alpine package version 1.24.5-r0. The upstream Go fix is bundled into this Alpine package revision, though the specific technical nature of the flaw - whether in the runtime, standard library, compiler, or toolchain - is not disclosed in available intelligence. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.
Technical ContextAI
The affected component is the Go programming language distribution as packaged for Alpine Linux, a musl libc-based minimal Linux distribution commonly used in container images. Alpine packages Go under the 'go' package name, and version 1.24.5-r0 represents the Alpine package revision incorporating the upstream Go 1.24.5 release or a security patch applied on top of it. No CWE classification is available in the provided intelligence, meaning the root cause class - whether memory safety, input validation, cryptographic weakness, or logic flaw - cannot be characterized from available data. No CPE strings were supplied to further narrow affected configurations.
Affected ProductsAI
The affected product is the Go language package as distributed by Alpine Linux, in versions prior to 1.24.5-r0. Alpine Linux is the sole confirmed affected platform per the reporting source (vendor:alpine). Specific Alpine Linux branches or versions affected (e.g., Alpine 3.18, 3.19, 3.20, edge) are not identified in the available intelligence. No CPE strings were provided. Upstream Go versions corresponding to this Alpine package revision are not specified in the available data. Users should consult the Alpine Linux security tracker for branch-specific applicability.
RemediationAI
Update the Alpine Linux 'go' package to version 1.24.5-r0 or later using the Alpine package manager: 'apk upgrade go'. This is the vendor-confirmed fix per the Alpine security advisory. Container image maintainers should rebuild images that include the Go toolchain from Alpine base layers to incorporate the patched package. If immediate patching is not feasible, assess whether the affected Go functionality is exercised in the deployed environment; however, specific workarounds cannot be recommended because the technical nature of the vulnerability is undisclosed in available data. Consult the Alpine Linux security tracker and upstream Go release notes for 1.24.5 to determine whether additional compensating controls are applicable.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today