Back Linuxsecurity

Ubuntu 22: gdu 5.32.1 Significant CrossSiteSecurity Update 2025

Linuxsecurity •LinuxSecurity Advisories • December 28, 2025

Fast disk usage analyzer with console interface written in Go. Update Information : Update to 5.32.0

Fast disk usage analyzer with console interface written in Go.

* Fri Dec 19 2025 Mikel Olasagasti Uranga - 5.32.0-1 - Update to 5.32.0 - Closes rhbz#2416550

[ 1 ] Bug #2398687 - CVE-2025-47910 gdu: CrossOriginProtection bypass in net/http [fedora-42] [ 2 ] Bug #2399368 - CVE-2025-47906 gdu: Unexpected paths returned from LookPath in os/exec [fedora-42] [ 3 ] Bug #2407890 - CVE-2025-58189 gdu: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] [ 4 ] Bug #2409359 - CVE-2025-61723 gdu: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] [ 5 ] Bug #2410309 - CVE-2025-58185 gdu: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-3b0fa1ac26' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affect gdu in Fedora 43 and Ubuntu 22 A critical update was issued for the gdu disk usage analyzer in both Fedora 43 and Ubuntu 22 due to multiple vulnerabilities. The vulnerabilities include CVE-2025-58189, which involves an ALPN negotiation error, and CVE-2025-47910, related to Cross-Origin Protection bypass. Users of both distributions are advised to update to version 5.32.0 to mitigate these issues. 2 sources 34

Extracted Entities

CVEs (5)

CVE-2025-47906 CVE-2025-47910 CVE-2025-58185 CVE-2025-58189 CVE-2025-61723