Skip to contentGo Toolchain Cmd/go vulnerabilities
- go toolchain cmd/compile, cmd/go +1 moreUnexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compileCVE-2026-97043Fix availableNo score
- go toolchain cmd/go, cmd/link +1 moreCgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/linkCVE-2026-97040Fix availableNo score
- go toolchain cmd/goFlag sanitization bypass via "#cgo pkg-config:" directives in cmd/goCVE-2026-97039Fix availableNo score
- go toolchain cmd/goArbitrary code execution via crafted .syso files and cgo linker input files in cmd/goCVE-2026-97038Fix availableNo score
- go toolchain cmd/goLinker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goCVE-2026-97037Fix availableNo score
- go toolchain cmd/goArbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goCVE-2026-97036Fix availableNo score
- go toolchain cmd/goUnexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/goCVE-2026-97035Fix availableNo score
- go toolchain cmd/goArbitrary command execution via GCC spec files in cgo linker search directories in cmd/goCVE-2026-97034Fix availableNo score
- go toolchain cmd/goUnexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goCVE-2026-97033Fix availableNo score
- go toolchain cmd/goChecksum database bypass for golang.org/toolchain in cmd/goCVE-2026-94447Fix available7.8 High
- go toolchain cmd/goChecksum bypass for golang.org/fips140 in cmd/goCVE-2026-94444Fix available7.8 High
- golang.org/x/mod golang.org/x/mod/sumdb/tlog, go toolchain cmd/go +1 moreFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogCVE-2026-56865Fix available8.4 High
- golang.org/x/mod golang.org/x/mod/sumdb, go toolchain cmd/go +1 moreIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbCVE-2026-56864Fix available7.5 High
- go toolchain cmd/go, golang go +1 moreMalicious module proxy can bypass checksum database in cmd/goCVE-2026-42501Fix available7.5 High
- go toolchain cmd/go, golang go +1 moreInvoking "go bug" follows symlinks in predictable temporary filenames in cmd/goCVE-2026-39819Fix available5.3 Medium
- go toolchain cmd/go, golang go +1 moreInvoking "go tool pack" does not sanitize output paths in cmd/goCVE-2026-39817Fix available5.9 Medium
- go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 moreCode execution vulnerability in SWIG code generation in cmd/goCVE-2026-27140Fix available8.8 High
- go toolchain cmd/go, golang go, red hat enterprise linux 10 +30 more +32 moreArbitrary file write using cgo pkg-config directive in cmd/goCVE-2025-61731Fix available7.8 High
- go toolchain cmd/go, golang go +1 moreUnexpected code execution when invoking toolchain in cmd/goCVE-2025-68119Fix available7.0 High
- go toolchain cmd/go, golang go +1 moreUnexpected command execution in untrusted VCS repositories in cmd/goCVE-2025-4674Fix available8.6 High
- go toolchain cmd/goArbitrary code execution during build on darwin in cmd/goCVE-2025-22867Fix available7.5 High
- go toolchain cmd/goGOAUTH credential leak in cmd/goCVE-2024-45340Fix available8.8 High
- go toolchain cmd/go, gotoolchain cmd\/go +1 moreOutput of "go env" does not sanitize values in cmd/goCVE-2023-24531Fix available9.8 Critical
- go toolchain cmd/go, golang go +1 moreArbitrary code execution during build on Darwin in cmd/goCVE-2024-24787Public exploitFix available6.4 Medium
- go toolchain cmd/go, golang go +1 moreCommand 'go get' may unexpectedly fallback to insecure git in cmd/goCVE-2023-45285Fix available7.5 High
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreArbitrary code execution during build via line directives in cmd/goCVE-2023-39323Fix available8.1 High
- go toolchain cmd/go, golang go +1 moreArbitrary code execution via go.mod toolchain directive in cmd/goCVE-2023-39320Public exploitFix available9.8 Critical
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreCode injection via go command with cgo in cmd/goCVE-2023-29402Fix available9.8 Critical
- go toolchain cmd/go, golang go, fedoraproject fedora +1 more +3 moreImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goCVE-2023-29405Fix available9.8 Critical
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goCVE-2023-29404Fix available9.8 Critical
- go toolchain cmd/go, golang go +1 moreArbitrary code execution via the go command with cgo in cmd/goCVE-2020-28367Fix available7.5 High
- go toolchain cmd/cgo, cmd/go, golang go +3 more +5 moreArbitrary code execution in go command with cgo in cmd/go and cmd/cgoCVE-2020-28366Fix available7.5 High