High WID-SEC-2026-1006 10 CVEs

Golang Go: Mehrere Schwachstellen

Published Apr 7, 2026 · Updated Nov 12, 2026 · Revision 112 · de

Vendor: amazon Vendor: golang Vendor: Google Vendor: IBM Vendor: Microsoft Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SolarWinds Vendor: Splunk Vendor: SUSE Product: Ansible Automation Platform Product: Azure Linux Product: Business Automation Workflow Product: Container-Optimized OS Product: Enterprise Product: Enterprise Linux Product: Go Product: Linux Product: Linux Product: Linux 2 Product: openshift Product: OpenStack Product: openSUSE Product: Platform Product: Rocky Linux Product: Security Verify Access Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Go ist eine quelloffene Programmiersprache.

Vulnerabilities 10

Critical 9.8

CVE-2026-27143

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Go toolchain cmd/compile katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 8.8

CVE-2026-27140

Code execution vulnerability in SWIG code generation in cmd/go

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32280

Unexpected work during chain building in crypto/x509

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32281

Inefficient policy validation in crypto/x509

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32283

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-33810

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.1

CVE-2026-27144

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Go toolchain cmd/compile katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 6.4

CVE-2026-32282

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 6.1

CVE-2026-32289

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, le…

Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 5.5

CVE-2026-32288

Unbounded allocation for old GNU sparse in archive/tar

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Go standard library archive/tar golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026

Revision history

2026-11-12 #112
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
2026-11-11 #111
Neue Updates von Red Hat aufgenommen
2026-11-10 #110
Neue Updates von Red Hat aufgenommen
2026-11-08 #109
Neue Updates von Red Hat aufgenommen
2026-11-05 #108
Neue Updates von Red Hat aufgenommen
2026-11-04 #107
Neue Updates von Red Hat aufgenommen
2026-11-02 #106
Neue Updates von Red Hat aufgenommen
2026-11-01 #105
Neue Updates von Red Hat aufgenommen
2026-10-28 #104
Neue Updates von Red Hat aufgenommen
2026-10-27 #103
Neue Updates von Red Hat aufgenommen
2026-10-26 #102
Neue Updates von Red Hat aufgenommen
2026-10-22 #101
Neue Updates von Red Hat aufgenommen
2026-10-21 #100
Neue Updates von Red Hat aufgenommen
2026-10-14 #99
Neue Updates von Red Hat aufgenommen
2026-10-11 #98
Neue Updates von Red Hat aufgenommen
2026-10-06 #97
Neue Updates von Red Hat aufgenommen
2026-10-04 #96
Neue Updates von IBM aufgenommen
2026-10-01 #95
Neue Updates von Red Hat aufgenommen
2026-09-28 #94
Neue Updates von Red Hat aufgenommen
2026-09-27 #93
Neue Updates von Red Hat aufgenommen
2026-09-23 #92
Neue Updates von Red Hat und Oracle Linux aufgenommen
2026-09-22 #91
Neue Updates von Red Hat aufgenommen
2026-09-21 #90
Neue Updates von Red Hat aufgenommen
2026-09-20 #89
Neue Updates von Red Hat aufgenommen
2026-09-16 #88
Neue Updates von Red Hat aufgenommen

References

Go 1.26.2 and Go 1.25.9 releases vom 2026-04-07
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
openSUSE Security Update OPENSUSE-SU-2026:10514-1 vom 2026-04-10
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIFYJ3KCIJYPIKUGNHN2MS6KKEB6TGGF/
SUSE Security Update SUSE-SU-2026:1320-1 vom 2026-04-14
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025336.html
Microsoft Security Update Guide vom 2026-04-14
https://msrc.microsoft.com/update-guide/
SUSE Security Update SUSE-SU-2026:1321-1 vom 2026-04-14
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025335.html
openSUSE Security Update OPENSUSE-SU-2026:20570-1 vom 2026-04-21
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SQT5EUOF2E2KJWKJ36C75FCCQIOCQMQL/
openSUSE Security Update OPENSUSE-SU-2026:20571-1 vom 2026-04-21
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RQFYGQRFE62FS4PPTIBWFMAPVOHKEBWJ/
Red Hat Security Advisory RHSA-2026:10155 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10155
Red Hat Security Advisory RHSA-2026:10217 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10217
Red Hat Security Advisory RHSA-2026:10158 vom 2026-04-23
https://access.redhat.com/errata/RHSA-2026:10158
SUSE Security Update SUSE-SU-2026:1581-1 vom 2026-04-24
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025608.html
SUSE Security Update SUSE-SU-2026:1580-1 vom 2026-04-24
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025609.html
Oracle Linux Security Advisory ELSA-2026-10219 vom 2026-04-24
https://linux.oracle.com/errata/ELSA-2026-10219.html
Oracle Linux Security Advisory ELSA-2026-10217 vom 2026-04-24
https://linux.oracle.com/errata/ELSA-2026-10217.html
Red Hat Security Advisory RHSA-2026:11330 vom 2026-04-28
https://access.redhat.com/errata/RHSA-2026:11330
Red Hat Security Advisory RHSA-2026:11331 vom 2026-04-28
https://access.redhat.com/errata/RHSA-2026:11331
Oracle Linux Security Advisory ELSA-2026-10704 vom 2026-04-28
https://linux.oracle.com/errata/ELSA-2026-10704.html
SUSE Security Update SUSE-SU-2026:21356-1 vom 2026-04-28
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025747.html
SUSE Security Update SUSE-SU-2026:21355-1 vom 2026-04-28
https://lists.suse.com/pipermail/sle-security-updates/2026-April/025748.html
Red Hat Security Advisory RHSA-2026:11408 vom 2026-04-28
https://access.redhat.com/errata/RHSA-2026:11408
Red Hat Security Advisory RHSA-2026:11507 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11507
Red Hat Security Advisory RHSA-2026:11514 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11514
Oracle Linux Security Advisory ELSA-2026-11514 vom 2026-04-30
https://linux.oracle.com/errata/ELSA-2026-11514.html
Oracle Linux Security Advisory ELSA-2026-11507 vom 2026-04-30
https://linux.oracle.com/errata/ELSA-2026-11507.html
Oracle Linux Security Advisory ELSA-2026-11704 vom 2026-04-30
https://linux.oracle.com/errata/ELSA-2026-11704.html
Oracle Linux Security Advisory ELSA-2026-11711 vom 2026-04-30
https://linux.oracle.com/errata/ELSA-2026-11711.html
Red Hat Security Advisory RHSA-2026:11688 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11688
Red Hat Security Advisory RHSA-2026:11704 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11704
Red Hat Security Advisory RHSA-2026:11712 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11712
Red Hat Security Advisory RHSA-2026:11803 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11803
Red Hat Security Advisory RHSA-2026:11863 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11863
Red Hat Security Advisory RHSA-2026:11881 vom 2026-04-29
https://access.redhat.com/errata/RHSA-2026:11881
Amazon Linux Security Advisory ALAS2DOCKER-2026-111 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-111.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-097 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-097.html
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-098 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-098.html
Amazon Linux Security Advisory ALAS2DOCKER-2026-112 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-112.html
Oracle Linux Security Advisory ELSA-2026-11712 vom 2026-04-30
https://linux.oracle.com/errata/ELSA-2026-11712.html
Amazon Linux Security Advisory ALAS2-2026-3259 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2-2026-3259.html
Amazon Linux Security Advisory ALAS2-2026-3260 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2-2026-3260.html
Amazon Linux Security Advisory ALAS2-2026-3265 vom 2026-04-30
https://alas.aws.amazon.com/AL2/ALAS2-2026-3265.html
Red Hat Security Advisory RHSA-2026:7385 vom 2026-05-02
https://access.redhat.com/errata/RHSA-2026:7385
Container-Optimized OS release notes vom 2026-05-02
https://docs.cloud.google.com/container-optimized-os/docs/release-notes#May_01_2026
Oracle Linux Security Advisory ELSA-2026-11881 vom 2026-05-01
http://linux.oracle.com/errata/ELSA-2026-11881.html
Red Hat Security Advisory RHSA-2026:13545 vom 2026-05-04
https://access.redhat.com/errata/RHSA-2026:13545
openSUSE Security Update OPENSUSE-SU-2026:10673-1 vom 2026-05-05
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q3OZSPPM6XK6DDXQVFJ4HPEX7OWUAW42/
Red Hat Security Advisory RHSA-2026:13826 vom 2026-05-05
https://access.redhat.com/errata/RHSA-2026:13826
Red Hat Security Advisory RHSA-2026:14162 vom 2026-05-06
https://access.redhat.com/errata/RHSA-2026:14162
Red Hat Security Advisory RHSA-2026:14391 vom 2026-05-07
https://access.redhat.com/errata/RHSA-2026:14391
Oracle Linux Security Advisory ELSA-2026-14200 vom 2026-05-07
https://linux.oracle.com/errata/ELSA-2026-14200.html
Rocky Linux Security Advisory RLSA-2026:11704 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11704
Rocky Linux Security Advisory RLSA-2026:11514 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11514
Red Hat Security Advisory RHSA-2026:14200 vom 2026-05-06
https://access.redhat.com/errata/RHSA-2026:14200
Rocky Linux Security Advisory RLSA-2026:11507 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11507
Rocky Linux Security Advisory RLSA-2026:10704 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:10704
Rocky Linux Security Advisory RLSA-2026:10219 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:10219
Rocky Linux Security Advisory RLSA-2026:10217 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:10217
Rocky Linux Security Advisory RLSA-2026:11881 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11881
Rocky Linux Security Advisory RLSA-2026:11712 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11712
Red Hat Security Advisory RHSA-2026:14020 vom 2026-05-06
https://access.redhat.com/errata/RHSA-2026:14020
Rocky Linux Security Advisory RLSA-2026:11711 vom 2026-05-06
https://errata.build.resf.org/RLSA-2026:11711
Rocky Linux Security Advisory RLSA-2026:14200 vom 2026-05-08
https://errata.build.resf.org/RLSA-2026:14200
Red Hat Security Advisory RHSA-2026:16101 vom 2026-05-12
https://access.redhat.com/errata/RHSA-2026:16101
Red Hat Security Advisory RHSA-2026:16102 vom 2026-05-12
https://access.redhat.com/errata/RHSA-2026:16102
Red Hat Security Advisory RHSA-2026:16021 vom 2026-05-11
https://access.redhat.com/errata/RHSA-2026:16021
Red Hat Security Advisory RHSA-2026:15980 vom 2026-05-11
https://access.redhat.com/errata/RHSA-2026:15980
Red Hat Security Advisory RHSA-2026:16024 vom 2026-05-11
https://access.redhat.com/errata/RHSA-2026:16024
Red Hat Security Advisory RHSA-2026:16476 vom 2026-05-12
https://access.redhat.com/errata/RHSA-2026:16476
Red Hat Security Advisory RHSA-2026:16477 vom 2026-05-12
https://access.redhat.com/errata/RHSA-2026:16477
Red Hat Security Advisory RHSA-2026:16508 vom 2026-05-12
https://access.redhat.com/errata/RHSA-2026:16508
Red Hat Security Advisory RHSA-2026:16535 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16535
Red Hat Security Advisory RHSA-2026:16505 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16505
Red Hat Security Advisory RHSA-2026:16694 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16694
Red Hat Security Advisory RHSA-2026:16697 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16697
Red Hat Security Advisory RHSA-2026:16698 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16698
Red Hat Security Advisory RHSA-2026:16875 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16875
Oracle Linux Security Advisory ELSA-2026-17075 vom 2026-05-15
http://linux.oracle.com/errata/ELSA-2026-17075.html
Red Hat Security Advisory RHSA-2026:17075 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:17075
Red Hat Security Advisory RHSA-2026:17287 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:17287
Red Hat Security Advisory RHSA-2026:17084 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:17084
Red Hat Security Advisory RHSA-2026:16874 vom 2026-05-13
https://access.redhat.com/errata/RHSA-2026:16874