Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: go fixed in 1.25.2-r0
AnalysisAI
CVE-2025-58187 records a vulnerability in the Go programming language package as distributed by Alpine Linux, addressed in package version 1.25.2-r0. The nature, severity, and impact of the underlying vulnerability are entirely absent from the CVE record - no description, CVSS score, or CWE classification has been published. The EPSS score of 0.02% at the 6th percentile reflects very low modeled exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected component is the Go language runtime and toolchain (package name 'go') as packaged and distributed by Alpine Linux. Alpine Linux uses the versioning scheme upstream_version-rN, meaning 1.25.2-r0 corresponds to Go upstream version 1.25.2, Alpine package revision 0. No CPE strings were provided to narrow the affected sub-components (e.g., net/http, crypto/tls, encoding packages). No CWE classification is available, so the root cause class - whether memory safety, logic error, input validation, or other - cannot be identified from the available data. The fix exists in the Alpine Linux package repository and was reported solely by the Alpine vendor source.
Affected ProductsAI
The Alpine Linux 'go' package in versions prior to 1.25.2-r0 is confirmed affected, as reported exclusively by the Alpine Linux vendor. This corresponds to the Go upstream version 1.25.2 as packaged for Alpine Linux repositories. No CPE strings were provided to identify specific Alpine Linux release branches (e.g., edge, v3.20, v3.21) carrying the vulnerable package version. Go installations obtained directly from golang.org or distributed by other Linux distributions are not confirmed affected by this specific Alpine-scoped advisory, though they may be subject to the same upstream Go vulnerability if one exists.
RemediationAI
Update the Alpine Linux 'go' package to version 1.25.2-r0 or later by running 'apk upgrade go' on affected Alpine Linux systems. The vendor-released fix is confirmed at go 1.25.2-r0 per the Alpine Linux vendor report. No workarounds or compensating controls are documented in the available data. If immediate patching is not feasible, restricting deployment of untrusted Go-compiled binaries or disabling Go-based services processing untrusted input is a general precaution, though its relevance depends on the unknown vulnerability type. Monitor the Alpine Linux security advisory tracker for additional details and any affected-branch clarifications.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today