GO-2026-6893
Event type spoofing via UntrustedType in github.com/google/go-eventlog
GO-2026-6893 is a vulnerability with no CVSS score yet in github.com/google/go-eventlog, published November 5, 2026. No source lists public exploit code. Fixed in github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.0.3-0.20261001001437-1991f15bc4b0github.com/google/go-eventlog
Description
In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/google/go-eventlogGo | before 0.0.3-0.20261001001437-1991f15bc4b0 | 0.0.3-0.20261001001437-1991f15bc4b0 |
What each source reports
OSVNo score
Event type spoofing via UntrustedType in github.com/google/go-eventlog
In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.
- Record
GO-2026-6893- Updated
- 2026-11-06
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.