Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: go fixed in 1.25.2-r0
AnalysisAI
CVE-2025-58188 represents a security fix applied to the Go language package in Alpine Linux, addressed in package version 1.25.2-r0. The nature, class, and precise impact of the underlying vulnerability are not disclosed in available data - only the fix version is confirmed. With an EPSS score of 0.01% (2nd percentile) and no CISA KEV listing, real-world exploitation is assessed as highly unlikely at this time. Security teams maintaining Alpine Linux environments running the Go runtime or toolchain should treat this as a routine patching obligation pending further vendor disclosure.
Technical ContextAI
The affected component is the Go programming language package as distributed by Alpine Linux. Alpine packages Go using its own versioning convention where '1.25.2-r0' denotes Go upstream version 1.25.2 packaged as Alpine revision 0. The underlying vulnerability class (CWE) is not disclosed. No CPE strings were provided, so the exact scope across Go versions or platforms beyond Alpine Linux cannot be confirmed from available data. The Go runtime and toolchain encompass a broad attack surface including the standard library, compiler, linker, and HTTP/crypto packages - but which component contains this flaw is unknown. The absence of a CVSS vector makes it impossible to confirm whether this is a runtime vulnerability, a build-time issue, or a toolchain flaw.
Affected ProductsAI
The affected product is the Go language package as distributed by Alpine Linux, in versions prior to 1.25.2-r0. The fix is confirmed in Alpine package go-1.25.2-r0. Specific affected version ranges below 1.25.2-r0 within Alpine are not enumerated in available data. No CPE strings were provided. Whether upstream Go (golang.org) distributions outside of Alpine are affected by the same underlying issue is not confirmed from this advisory alone. Refer to Alpine Linux security advisories for the authoritative affected version list.
RemediationAI
The primary remediation is to upgrade the Alpine Linux Go package to version 1.25.2-r0 or later using the Alpine package manager: 'apk upgrade go'. This is the only confirmed fix - no upstream Go advisory URL or patch commit was provided in available data, so the exact fix cannot be independently verified beyond Alpine's package release. No workarounds or compensating controls are documented for this CVE. If upgrading immediately is not possible, consider whether systems use Go only as a build-time dependency (lower runtime exposure) versus as a runtime component in production services (higher exposure). Consult the Alpine Linux security tracker for the official advisory and any additional guidance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today