Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
https://pkg.go.dev/vuln/GO-2025-3955 This CVE affects golang apps built with golang "from go1.25.0 before go1.25.1", so really just golang 1.25.0 exactly. Here is the status across all current Fedora versions. * vhs-0.11.0-1.fc45 was built with golang-1.26.1-1.fc45, and thus is not affected. * vhs-0.11.0-1.fc44 was built with golang-1.26.1-1.fc44, and thus is not affected. * vhs-0.10.0-3.fc43 was built with golang-1.25.0-1.fc43, and thus is affected. * vhs-0.9.0-1.fc42 was built with golang-1.24.2-1.fc42, and thus is not affected.
FEDORA-2026-7646f2a691 (vhs-0.10.0-4.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-7646f2a691
FEDORA-2026-7646f2a691 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-7646f2a691` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-7646f2a691 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-7646f2a691 (vhs-0.10.0-4.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.