Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: go fixed in 1.25.2-r0
AnalysisAI
Go runtime/toolchain package on Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The underlying nature, impact class, and affected component within Go are not disclosed in available intelligence sources. EPSS score of 0.04% (14th percentile) indicates a low current probability of observed exploitation, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected product is the Go programming language runtime and/or toolchain as packaged by Alpine Linux. Alpine Linux uses its own package versioning convention (e.g., 1.25.2-r0 means upstream Go 1.25.2, Alpine revision 0). The specific Go subsystem affected - whether the standard library, compiler, linker, net/http stack, crypto package, or runtime - is not identified in available data. No CWE classification has been assigned, preventing root-cause class analysis. No CPE strings are available to bound the affected version range beyond inferring that versions prior to the Alpine package 1.25.2-r0 are vulnerable.
Affected ProductsAI
The affected product is the Go programming language as distributed by Alpine Linux. The fix is confirmed in Alpine package version 1.25.2-r0 (corresponding to upstream Go 1.25.2). Versions of Alpine's go package prior to 1.25.2-r0 are presumed affected, though the exact lower bound of the vulnerable range is not established in available data. No CPE strings are available. The specific Alpine Linux release branch(es) carrying the vulnerable package are not identified. No upstream Go project advisory URL is available in the provided references.
RemediationAI
Update the Alpine Linux go package to version 1.25.2-r0 or later using the standard Alpine package manager: 'apk upgrade go'. This is the vendor-confirmed fix per Alpine's security tracking. No workarounds or compensating controls are identifiable because the vulnerability's affected component and attack surface are unknown. If immediate patching is not possible, consider restricting untrusted input to any Go-based services until the upstream Go advisory is located and reviewed. No additional advisory URL is available in the provided data - consult Alpine Linux's security tracker and the official Go security release notes for Go 1.25.2 to obtain full remediation guidance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today