Is there a patch available for CVE-2025-61724?

Yes, a patch is available for CVE-2025-61724. Update the affected software to the latest version immediately.

Alpine Linux Go CVE-2025-61724

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:49 vuln.today

DescriptionCVE.org

Alpine Linux: go fixed in 1.25.2-r0

AnalysisAI

Go language runtime patched in Alpine Linux package version 1.25.2-r0 addresses an unspecified vulnerability with no disclosed technical details at time of analysis. The affected component is the Go toolchain/runtime as distributed by the Alpine Linux project. With an EPSS score of 0.02% (7th percentile) and no CVSS scoring, KEV listing, or public exploit, the real-world risk profile is currently low and uncharacterized.

Technical ContextAI

The affected component is the Go programming language package as maintained and distributed by Alpine Linux. Alpine packages Go under its own versioning scheme (e.g., 1.25.2-r0 denotes Alpine package revision r0 of upstream Go 1.25.2 or a related version). No CWE classification, CVSS vector, or vulnerability description beyond the fix notation has been provided, making it impossible to determine the root cause class, affected subsystem (compiler, runtime, standard library, crypto package, net/http, etc.), or upstream Go CVE correlation at time of analysis.

Affected ProductsAI

The affected product is the Go language package as distributed by Alpine Linux, fixed in Alpine package version 1.25.2-r0. No CPE strings, upstream Go version range, or specific Alpine Linux branch (e.g., edge, v3.x) are provided in the available intelligence. Users running earlier Go package revisions on Alpine Linux prior to 1.25.2-r0 should be considered potentially affected. No vendor advisory URL beyond the Alpine package bump was provided.

RemediationAI

Upgrade the Go package on Alpine Linux to version 1.25.2-r0 or later using the Alpine package manager: 'apk upgrade go'. This is the vendor-confirmed fix per Alpine Linux. No upstream Go advisory URL, patch notes, or workaround information was provided in the available data. Because the vulnerability class is unknown, no targeted compensating controls can be recommended. If immediate patching is not possible, consider restricting execution of Go-compiled binaries or the Go toolchain to trusted users and environments as a generic precaution, with the trade-off of disrupted development or build pipelines.