Back Linuxsecurity

Fedora 42: gosec Security Update 2.22.11 CVE-2025

Linuxsecurity •LinuxSecurity Advisories • December 20, 2025

* Thu Dec 11 2025 Mikel Olasagasti Uranga - 2.22.11-2 - Fix build * Thu Dec 11 2025 Mikel Olasagasti Uranga - 2.22.11-1 - Update to 2.22.11 - Closes rhbz#2388620 * Fri Oct 10 2025 Maxwell G - 2.22.7-3 - Rebuild for golang 1.25.2 * Fri Aug 15 2025 Maxwell G - 2.22.7-2 - Rebuild for golang-1.25.0

[ 1 ] Bug #2398826 - CVE-2025-47910 gosec: CrossOriginProtection bypass in net/http [fedora-42] [ 2 ] Bug #2399498 - CVE-2025-47906 gosec: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 3 ] Bug #2408033 - CVE-2025-58189 gosec: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] [ 4 ] Bug #2409501 - CVE-2025-61723 gosec: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] [ 5 ] Bug #2410452 - CVE-2025-58185 gosec: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42] [ 6 ] Bug #2411351 - CVE-2025-58188 gosec: Panic when validating certificates with DSA public k... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-447e38400e' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 42 Updates: golang-github-projectdiscovery and gosec Security Fixes Fedora 42 has released updates for two packages: golang-github-projectdiscovery and gosec. The updates include version 1.1.97 for the utility program and version 2.22.11 for gosec, addressing various issues and rebuilding for compatibility with golang version 1.25.0 and 1.25.2, respectively. 2 sources 25

Extracted Entities

CVEs (6)

CVE-2025-47906 CVE-2025-47910 CVE-2025-58185 CVE-2025-58188 CVE-2025-58189 CVE-2025-61723