Skip to content
OpenAdvisories
Medium WID-SEC-2026-4370 12 CVEs

Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Nov 5, 2026 · Updated Nov 12, 2026 · Revision 4 · de

Vendor: golang Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Go Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Go ist eine quelloffene Programmiersprache.

Vulnerabilities 12

  • Unscored —
    CVE-2026-97033

    Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

    Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97034

    Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

    When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97035

    Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

    When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97036

    Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

    On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

    Go toolchain cmd/go golang golang-1.8 Debian Ubuntu Azure Linux Go
  • Unscored —
    CVE-2026-97037

    Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

    Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97038

    Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go

    Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries…

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97039

    Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

    Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "…

    Go toolchain cmd/go golang go Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97040

    Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link

    Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O,…

    Go toolchain cmd/go cmd/link golang Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97041

    Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

    Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", …

    Go toolchain cmd/compile cmd/link golang Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97042

    Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link

    Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_…

    Go toolchain cmd/compile cmd/cgo cmd/link Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97043

    Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile

    Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "_cgo_gotypes.…

    Go toolchain cmd/go cmd/compile golang Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2026-97054

    HTTP/1 server crash due to MaxBytesReader header race in net/http

    For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

    Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Revision history

  1. #4

    Neue Updates von SUSE aufgenommen

  2. #3

    Neue Updates von Red Hat aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-123112, EUVD-2026-123103, EUVD-2026-123102, EUVD-2026-123113, EUVD-2026-123111, EUVD-2026-123110, EUVD-2026-123109, EUVD-2026-123108, EUVD-2026-123107, EUVD-2026-123106, EUVD-2026-123105, EUVD-2026-123104

  4. #1

    Initiale Fassung

References