Description
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | golang | 1.10.6, 1.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u3 | DLA-2591-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u3 | DLA-2592-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP6 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | containerd | 1.2.5-5.13.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker | 18.09.6_ce-6.17.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-6.18.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-4.12.1 | SUSE-SU-2019:1234-2 |
| SLES 15 SP1 | helm-mirror | 0.2.1-1.7.1 | SUSE-SU-2019:0048-2 |
| SLES 15 | containerd | 1.1.2-5.3.4 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | docker | 18.06.1_ce-6.8.2 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | docker-runc | 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | golang-github-docker-libnetwork | 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 | SUSE-SU-2019:1234-1, SUSE-SU-2019:0495-1, SUSE-SU-2019:0286-1 |
| SLES 15 | helm-mirror | 0.2.1-1.7.1 | SUSE-SU-2019:0048-1 |
| SLES 12 SP5 | docker-stable | 24.0.9_ce-1.20.1 | SUSE-SU-2025:03540-1 |
| SLES 12 | containerd | 1.2.2-16.14.2 | SUSE-SU-2021:1458-1, SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | docker | 18.09.1_ce-98.34.2 | SUSE-SU-2021:1458-1, SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 | SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 | SUSE-SU-2019:1264-1, SUSE-SU-2019:0573-1 |
| SLES 12 | runc | 1.0.0~rc93-16.8.1 | SUSE-SU-2021:1458-1 |
| SLES for SAP 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES for SAP 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLES for SAP 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP5 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP4 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SLE HPC 15 SP3 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| SUSE Package Hub 15 | go | 1.12-bp150.2.6.1 | openSUSE-SU-2019:1506-1 |
| SUSE Package Hub 15 | runc | 1.0.0~rc6-bp150.2.3.1 | openSUSE-SU-2019:0170-1 |
| SUSE Package Hub 12 SP3 | helm | 2.13.1-5.1 | openSUSE-SU-2019:1703-1 |
| SUSE OpenStack Cloud 6 | containerd | 1.2.2-16.14.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | docker | 18.09.1_ce-98.34.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | docker-runc | 1.0.0rc6+gitr3748_96ec2177ae84-1.17.2 | SUSE-SU-2019:0573-1 |
| SUSE OpenStack Cloud 6 | golang-github-docker-libnetwork | 0.7.0.1+gitr2711_2cfbf9b1f981-16.2 | SUSE-SU-2019:0573-1 |
| SUSE Enterprise Storage 7.1 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.4.8-2.2 | openSUSE-SU-2024:10693-1 |
| openSUSE Tumbleweed | cri-o | 1.22.0-1.2 | openSUSE-SU-2024:10699-1 |
| openSUSE Tumbleweed | docker | 20.10.6_ce-2.1 | openSUSE-SU-2024:10722-1 |
| openSUSE Tumbleweed | docker-stable | 24.0.9_ce-15.1 | openSUSE-SU-2025:15589-1 |
| openSUSE Tumbleweed | etcd | 3.4.16-3.1 | openSUSE-SU-2024:10741-1 |
| openSUSE Tumbleweed | flannel | 0.14.0-1.2 | openSUSE-SU-2024:10761-1 |
| openSUSE Tumbleweed | go | 1.17-1.1 | openSUSE-SU-2024:10802-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Tumbleweed | helm | 3.6.3-1.1 | openSUSE-SU-2024:10841-1 |
| openSUSE Tumbleweed | helm-mirror | 0.3.1-1.9 | openSUSE-SU-2024:10842-1 |
| openSUSE Tumbleweed | helm3 | 3.19.2-1.1 | openSUSE-SU-2025:15779-1 |
| openSUSE Tumbleweed | runc | 1.0.2-1.2 | openSUSE-SU-2024:11358-1 |
| openSUSE Leap 15.6 | docker-stable | 24.0.9_ce-150000.1.25.1 | SUSE-SU-2025:03545-1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-150000.7.6.1 | SUSE-SU-2024:3656-1 |
| openSUSE Leap 15.5 | etcd | 3.5.12-150000.7.6.1 | SUSE-SU-2024:3656-1 |
| openSUSE Leap 15.1 | containerd | 1.2.5-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | cri-o | 1.17.1-lp151.2.2 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | cri-tools | 1.18.0-lp151.2.1 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | docker | 18.09.6_ce-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp151.3.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go | 1.12-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.11 | 1.11.9-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.12 | 1.12.4-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | go1.14 | 1.14-lp151.6.1 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.1 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp151.2.3.1 | openSUSE-SU-2019:1444-1 |
| openSUSE Leap 15.1 | kubernetes | 1.18.0-lp151.5.1 | openSUSE-SU-2020:0554-1 |
| openSUSE Leap 15.0 | containerd | 1.2.5-lp150.4.14.3 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker | 18.09.6_ce-lp150.5.17.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | docker-runc | 1.0.0rc6+gitr3804_2b18fe1d885e-lp150.5.21.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go | 1.12-lp150.2.11.1 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go1.11 | 1.11.9-lp150.9.3 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | go1.12 | 1.12.4-lp150.2.2 | openSUSE-SU-2019:1499-1 |
| openSUSE Leap 15.0 | golang-github-docker-libnetwork | 0.7.0.1+gitr2726_872f0a83c98a-lp150.3.14.1 | openSUSE-SU-2019:1499-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | toolchain | < 1.10.6 · >= 1.11.0-0, < 1.11.3 | 1.10.6, 1.11.3 | GO-2022-0190 |
Advisories 35
- openSUSE-SU-2025:15589-1 docker-stable-24.0.9_ce-15.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03545-1 Security update for docker-stable SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-2591-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2592-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:0048-1 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1234-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4297-1 Security update for containerd, docker and go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10761-1 flannel-0.14.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1444-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0573-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1499-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1703-1 Security update for helm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11358-1 runc-1.0.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0495-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10842-1 helm-mirror-0.3.1-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1264-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10741-1 etcd-3.4.16-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10693-1 containerd-1.4.8-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10722-1 docker-20.10.6_ce-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0048-2 Security update for helm-mirror SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10699-1 cri-o-1.22.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0554-1 Security update for kubernetes SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15779-1 helm3-3.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1234-2 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10841-1 helm-3.6.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0170-1 Security update for runc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3656-1 Security update for etcd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1506-1 Security update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:03540-1 Security update for docker-stable SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0286-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1458-1 Security update for containerd, docker, runc SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10802-1 go-1.17-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- GLSA-201812-09 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16874
- 106228 vdb-entry
- https://groups.google.com/forum/?pli=1#%21topic/golang-announce/Kw31K8G7Fi0
- openSUSE-SU-2019:1079 vendor-advisory
- openSUSE-SU-2019:1444 vendor-advisory
- openSUSE-SU-2019:1499 vendor-advisory
- openSUSE-SU-2019:1506 vendor-advisory
- openSUSE-SU-2019:1703 vendor-advisory
- openSUSE-SU-2020:0554 vendor-advisory
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update mailing-list
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update mailing-list