Skip to content
OpenAdvisories
High · 7.8 CVE-2025-61731 BIT-golang-2025-61731EUVD-2025-206447GO-2026-4339

Arbitrary file write using cgo pkg-config directive in cmd/go

Published Jan 28, 2026 · Updated Sep 10, 2026 · Assigned by Go

Vendor: Go toolchain Product: cmd/go Package: aactl Package: actions-runner-controller Package: age Package: amass Package: amazon-cloudwatch-agent-operator Package: apache-exporter Package: authservice Package: aws-eks-pod-identity-agent Package: aws-flb-cloudwatch Package: aws-flb-kinesis Package: aws-privateca-issuer Package: aws-signer-notation-plugin Package: aws-sigv4-proxy Package: azcopy Package: azure-ipam Package: azure-ipam-dropgz Package: azure-service-operator Package: azure-workload-identity-webhook Package: bank-vaults-template Package: bento Package: blobfuse2 Package: bom Package: boring-registry Package: calico-app-policy-3.31 Package: calico-felix-3.31 Package: calicoctl-3.31 Package: capslock Package: cargobump Package: cass-operator Package: cert-manager-cmctl Package: cert-manager-istio-csr Package: cfssl Package: cfssl-bundle Package: chart-testing Package: chisel Package: cilium-cli Package: clickhouse-operator-metrics-exporter Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-vsphere Package: cluster-api-gcp-controller Package: cluster-api-ipam-provider-in-cluster Package: confluent-cp-docker-utils Package: conftest Package: conjur-cli Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: cortex Package: cosign Package: critest Package: croc Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-azure-sql Package: crossplane-provider-family-aws Package: crossplane-provider-sql Package: ctop Package: custom-pod-autoscaler Package: dask-gateway-server Package: db-operator Package: dbmate Package: descheduler Package: dex Package: dkron Package: dkron-executor-grpc Package: dkron-executor-nats Package: dkron-executor-rabbitmq Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-syslog Package: docker-credential-ecr-login Package: docker-credential-gcr Package: docker-machine-driver-linode Package: dockerd-28 Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: eksctl Package: esbuild Package: etcd Package: extism Package: falco-no-driver Package: falcosidekick Package: ferretdb Package: fixuid Package: flannel Package: flux-image-automation-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: fluxcd-kustomize-mutating-webhook Package: frp Package: fuse-overlayfs-snapshotter Package: fzf Package: gatus Package: ghaudit Package: git-credential-oauth Package: git-lfs Package: git-sync Package: gitlab-docker-machine-18.7 Package: gitlab-runner-helper-18.7 Package: gitleaks Package: gitness Package: gke-gcloud-auth-plugin Package: go Package: go-1.20 Package: go-1.22 Package: go-1.23 Package: go-jsonnet Package: go-licenses Package: go-md2man Package: gobuster Package: gogatekeeper Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golangci-lint Package: goreleaser Package: gostatsd Package: gosu Package: govulncheck Package: gptscript Package: grafana-operator Package: grafana-rollout-operator Package: grpcurl Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: headlamp Package: helm-3 Package: helm-docs Package: helm-operator Package: helm-set-status Package: hey Package: hivemind Package: http-echo Package: hubble Package: hubble-ui-backend Package: hydra Package: influx Package: ingress-nginx-controller-1.12 Package: ini-file Package: ip-masq-agent Package: ipfs-cluster Package: jaeger-2-anonymizer Package: jaeger-2-es-index-cleaner Package: jaeger-2-es-rollover Package: jaeger-2-esmapping-generator Package: jaeger-2-jaeger Package: jaeger-2-remote-storage Package: jaeger-2-tracegen Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-multicall Package: k3s-static Package: k8s_gateway Package: kapp Package: kapp-controller Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kbld Package: kine Package: kor Package: kratos Package: kratos-protoc-gen Package: kserve-modelmesh-serving Package: ksops Package: kube-bench Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-logging-operator-custom-runner Package: kube-vip-cloud-provider Package: kubecolor Package: kubectl-1.30 Package: kubeflow-access-management Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubelet-csr-approver Package: kuberay-operator Package: kuberlr Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubernetes-release-go-runner Package: kubernetes-replicator Package: kubescape-operator Package: kubo Package: kuma-cni-2.12 Package: kuma-cni-2.13 Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kuma-install-cni-2.12 Package: kuma-install-cni-2.13 Package: kustomize Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: langfuse-3 Package: langfuse-3-worker Package: lazygit Package: licenseclassifier Package: linkerd2-proxy-init Package: litefs Package: litestream Package: local-path-provisioner Package: local-static-provisioner Package: lvm-driver Package: mage Package: manifest-tool Package: maru Package: mattermost-11.1 Package: mc Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metallb Package: metallb-controller Package: metallb-cp-tool Package: metallb-frr-compat Package: minio Package: minio-object-browser Package: minio-operator Package: minio-operator-sidecar Package: mkcert Package: mockgen Package: mods Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: nats-server-config-reloader Package: nats-top Package: nerdctl Package: neuvector-sigstore-interface Package: newrelic-fluent-bit-output Package: newrelic-infra-operator Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nginx-prometheus-exporter Package: nri-cassandra Package: nri-couchbase Package: nri-f5 Package: nri-haproxy Package: nri-jmx Package: nri-memcached Package: nri-mongodb Package: nri-nagios Package: nri-nginx Package: nri-postgresql Package: nri-rabbitmq Package: nri-redis Package: octo-sts Package: octo-sts-webhook Package: openbao-k8s Package: opencost Package: opensearch-k8s-operator Package: opentofu-1.9 Package: osv-scanner Package: paranoia Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: petname Package: pg_timetable Package: pg_user Package: pgpool2_exporter Package: podcli Package: policy-controller Package: policy-controller-tester Package: postgres-operator Package: protoc-gen-go Package: protoc-gen-go-grpc Package: pvc-autoresizer Package: rabbitmq-cluster-operator Package: rabbitmq-default-user-credential-updater Package: rabbitmq-messaging-topology-operator Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-machine Package: rancher-system-agent Package: rancher-system-upgrade-controller Package: rancher-telemetry Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: redis-operator Package: redka Package: restic Package: runc Package: s5cmd Package: sbom-convert Package: sbom-scorecard Package: sbomqs Package: scorecard Package: sealed-secrets Package: sealed-secrets-kubeseal Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: sftpgo-plugin-auth Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: slsa-verifier Package: sonobuoy Package: sops Package: spark-operator Package: spegel Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: spqr Package: src Package: src-fingerprint Package: sriov-network-device-plugin Package: stakater-reloader Package: steampipe Package: step Package: step-kms-plugin Package: swagger Package: temporal-ui-server Package: terraform Package: terraform-docs Package: terraform-mcp-server Package: terraform-provider-pagerduty Package: terraform-provider-time Package: tetra Package: tetragon-operator Package: tfsec Package: thanos-operator Package: timescaledb-parallel-copy Package: timescaledb-tune Package: timoni Package: tofu-controller Package: tofu-controller-runner Package: toolchain Package: traefik-3.6 Package: undock Package: vale Package: vault-benchmark Package: vault-k8s Package: vault-secrets-webhook Package: verticadb-operator Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: volume-modifier-for-k8s Package: wave Package: wazero Package: wgcf Package: whereabouts Package: wire-go Package: wuzz Package: x509-certificate-exporter Package: xcaddy Package: xeol Package: yace Package: ytt Package: yunikorn-k8shim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Affected products

VendorProductAffectedFixed
Go toolchain cmd/go < 1.24.12, 1.25.0 – < 1.25.6 1.24.12

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +1 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +3 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.10 No fix yet —
Ubuntu 16.04 LTS golang-1.10 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 golang +7 1.25.8-1.el10_1 RHSA-2026:5941
RHEL 9 golang +7 1.25.8-1.el9_7 RHSA-2026:5942
RHEL 8 delve 1.25.2-1.module+el8.10.0+23746+9db33b5e RHSA-2026:6949
RHEL 8 golang +7 1.25.8-1.module+el8.10.0+24168+9fd3a552 RHSA-2026:6949
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS golang +7 1.25.8-1.el10_0 RHSA-2026:5943
RHEL 9.6 EUS golang +7 1.25.8-1.el9_6 RHSA-2026:5944
RHEL 9.4 EUS golang +6 1.21.13-15.el9_4 RHSA-2026:7834
RHEL 9.2 E4S golang +6 1.19.13-24.el9_2 RHSA-2026:7833
RHEL 9.0 E4S golang +6 1.17.13-11.el9_0 RHSA-2026:7883
RHEL 8.8 TUS delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5 RHSA-2026:7877
RHEL 8.8 TUS go-toolset 1.19.13-4.module+el8.8.0+23976+18ba1869 RHSA-2026:7877
RHEL 8.8 TUS golang +6 1.19.13-23.module+el8.8.0+24152+a703511b RHSA-2026:7877
RHEL 8.8 E4S delve 1.9.1-1.module+el8.8.0+16778+5fbb74f5 RHSA-2026:7877
RHEL 8.8 E4S go-toolset 1.19.13-4.module+el8.8.0+23976+18ba1869 RHSA-2026:7877
RHEL 8.8 E4S golang +6 1.19.13-23.module+el8.8.0+24152+a703511b RHSA-2026:7877
RHEL 8.6 TUS delve 1.7.2-1.module+el8.6.0+12972+ebab5911 RHSA-2026:7876
RHEL 8.6 TUS go-toolset 1.17.13-2.module+el8.6.0+22782+bd95fb4c RHSA-2026:7876
RHEL 8.6 TUS golang +6 1.17.13-15.module+el8.6.0+24195+22baade4 RHSA-2026:7876
RHEL 8.6 E4S delve 1.7.2-1.module+el8.6.0+12972+ebab5911 RHSA-2026:7876
RHEL 8.6 E4S go-toolset 1.17.13-2.module+el8.6.0+22782+bd95fb4c RHSA-2026:7876
RHEL 8.6 E4S golang +6 1.17.13-15.module+el8.6.0+24195+22baade4 RHSA-2026:7876
RHEL 8.6 AUS delve 1.7.2-1.module+el8.6.0+12972+ebab5911 RHSA-2026:7876
RHEL 8.6 AUS go-toolset 1.17.13-2.module+el8.6.0+22782+bd95fb4c RHSA-2026:7876
RHEL 8.6 AUS golang +6 1.17.13-15.module+el8.6.0+24195+22baade4 RHSA-2026:7876
RHEL 8.4 EUS Long Life delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb RHSA-2026:7879
RHEL 8.4 EUS Long Life go-toolset 1.15.14-3.module+el8.4.0+22765+91da4d3f RHSA-2026:7879
RHEL 8.4 EUS Long Life golang +6 1.15.14-21.module+el8.4.0+24185+53e66e3d RHSA-2026:7879
RHEL 8.4 AUS delve 1.5.0-2.module+el8.4.0+8864+58b0fcdb RHSA-2026:7879
RHEL 8.4 AUS go-toolset 1.15.14-3.module+el8.4.0+22765+91da4d3f RHSA-2026:7879
RHEL 8.4 AUS golang +6 1.15.14-21.module+el8.4.0+24185+53e66e3d RHSA-2026:7879
RHEL 8.2 AUS delve 1.3.2-3.module+el8.2.0+5581+896cb53e RHSA-2026:7878
RHEL 8.2 AUS go-toolset 1.13.15-1.module+el8.2.0+7662+fa98b974 RHSA-2026:7878
RHEL 8.2 AUS golang +6 1.13.15-15.module+el8.2.0+24191+89968df7 RHSA-2026:7878
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 golang-src +3 1.25.8-1.el10_1.alma.1 ALSA-2026:5941
AlmaLinux 9 golang +7 1.25.8-1.el9_7 ALSA-2026:5942
AlmaLinux 8 delve 1.25.2-1.module_el8.10.0+4074+24330916 ALSA-2026:6949
AlmaLinux 8 golang +7 1.25.8-1.module_el8.10.0+4156+92f0ae2f ALSA-2026:6949

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 golang 1.25.8-1.el10_1 RLSA-2026:5941
Rocky Linux 9 golang 1.25.8-1.el9_7 RLSA-2026:5942
Rocky Linux 8 delve 1.25.2-1.module+el8.10.0+40035+ee0a7047 RLSA-2026:6949

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20122-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20122-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.24 1.24.12-1.1 openSUSE-SU-2026:10063-1
openSUSE Tumbleweed go1.25 1.25.6-1.1 openSUSE-SU-2026:10064-1
openSUSE Leap 16.0 coredns 1.14.2-bp160.1.1 openSUSE-SU-2026:20619-1
openSUSE Leap 16.0 go1.24 1.24.12-160000.1.1 openSUSE-SU-2026:20077-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.6-160000.1.1 openSUSE-SU-2026:20085-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260128T190828-150000.1.143.1 SUSE-SU-2026:0354-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 etcd 3.6.8-r0 —
Alpine v3.24 go 1.25.6-r0 —
Alpine v3.23 etcd 3.6.8-r0 —
Alpine v3.23 go 1.25.6-r0 —
Alpine v3.22 go 1.24.12-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-ssm-agent 3.3.3883.0-1.amzn2023 ALAS2023-2026-1499
Amazon Linux 2023 golang +6 1.24.12-1.amzn2023.0.1 ALAS2023-2026-1381
Amazon Linux 2 amazon-ssm-agent 3.3.3883.0-1.amzn2 ALAS2-2026-3207
Amazon Linux 2 golang +6 1.24.12-1.amzn2.0.1 ALAS2-2026-3136

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 golang +7 1.25.8-1.el10_1 ELSA-2026-5941
Oracle Linux 9 golang +7 1.25.8-1.el9_7 ELSA-2026-5942
Oracle Linux 8 delve 1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd ELSA-2026-6949
Oracle Linux 8 golang +7 1.25.8-1.module+el8.10.0+90863+afbc39cb ELSA-2026-6949

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r40 —
Wolfi rolling actions-runner-controller 0.13.1-r1 —
Wolfi rolling age 1.3.1-r1 —
Wolfi rolling amass 5.0.1-r4 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.3.1-r1 —
Wolfi rolling apache-exporter 1.0.12-r3 —
Wolfi rolling authservice 1.1.5-r3 —
Wolfi rolling aws-eks-pod-identity-agent 0.1.36-r2 —
Wolfi rolling aws-flb-cloudwatch 1.9.4-r23 —
Wolfi rolling aws-flb-kinesis 1.10.3-r4 —
Wolfi rolling aws-privateca-issuer 1.8.0-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.2292-r5 —
Wolfi rolling aws-sigv4-proxy 1.11-r1 —
Wolfi rolling azcopy 10.31.1-r1 —
Wolfi rolling azure-ipam 0.4.0-r11 —
Wolfi rolling azure-ipam-dropgz 0.4.0-r8 —
Wolfi rolling azure-service-operator 2.17.0-r1 —
Wolfi rolling azure-workload-identity-webhook 1.5.1-r6 —
Wolfi rolling bank-vaults-template 1.32.1-r1 —
Wolfi rolling bento +3 1.14.1-r1 —
Wolfi rolling blobfuse2 2.4.2-r8 —
Wolfi rolling bom 0.7.1-r4 —
Wolfi rolling boring-registry 0.16.6-r5 —
Wolfi rolling calico-felix-3.31 +1 3.31.3-r2 —
Wolfi rolling calicoctl-3.31 3.31.4-r1 —
Wolfi rolling capslock 0.3.1-r2 —
Wolfi rolling cargobump 0.1.1-r1 —
Wolfi rolling cass-operator 1.28.0-r3 —
Wolfi rolling cert-manager-cmctl 2.4.0-r2 —
Wolfi rolling cert-manager-istio-csr 0.15.0-r1 —
Wolfi rolling cfssl +1 1.6.5-r26 —
Wolfi rolling chart-testing 3.14.0-r3 —
Wolfi rolling chisel 1.11.3-r4 —
Wolfi rolling cilium-cli 0.19.0-r1 —
Wolfi rolling clickhouse-operator-metrics-exporter 0.25.6-r1 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r2 —
Wolfi rolling cluster-api-gcp-controller 1.10.0-r7 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.0.3-r4 —
Wolfi rolling confluent-cp-docker-utils 1.0.6-r1 —
Wolfi rolling conjur-cli 9.1.1-r1 —
Wolfi rolling container-object-storage-interface-controller 0.2.2-r1 —
Wolfi rolling container-object-storage-interface-sidecar 0.2.2-r3 —
Wolfi rolling cortex 1.20.1-r1 —
Wolfi rolling cosign 3.0.4-r2 —
Wolfi rolling critest +1 1.35.0-r1 —
Wolfi rolling croc 10.3.1-r2 —
Wolfi rolling crossplane-provider-aws-ec2 2.4.0-r1 —
Wolfi rolling crossplane-provider-aws-s3 +12 2.3.0-r3 —
Wolfi rolling crossplane-provider-azure-sql 2.3.0-r2 —
Wolfi rolling crossplane-provider-sql 0.13.0-r3 —
Wolfi rolling ctop 0.7.7-r30 —
Wolfi rolling custom-pod-autoscaler 2.12.2-r5 —
Wolfi rolling dask-gateway-server 2025.4.0-r7 —
Wolfi rolling db-operator 2.16.0-r4 —
Wolfi rolling dbmate 2.29.3-r1 —
Wolfi rolling descheduler 0.34.0-r3 —
Wolfi rolling dex 2.44.0-r8 —
Wolfi rolling dkron +6 4.0.9-r1 —
Wolfi rolling docker-credential-ecr-login 0.11.0-r2 —
Wolfi rolling docker-credential-gcr 2.1.31-r1 —
Wolfi rolling docker-machine-driver-linode 0.1.15-r9 —
Wolfi rolling dockerd-28 28.5.2-r13 —
Wolfi rolling dockerize 0.9.9-r1 —
Wolfi rolling doppler-kubernetes-operator 1.7.1-r3 —
Wolfi rolling dynamic-localpv-provisioner 4.4.0-r3 —
Wolfi rolling eksctl 0.221.0-r1 —
Wolfi rolling esbuild 0.27.2-r1 —
Wolfi rolling extism 1.6.3-r5 —
Wolfi rolling falco-no-driver 0.43.0-r1 —
Wolfi rolling falcosidekick 2.32.0-r4 —
Wolfi rolling ferretdb 2.7.0-r3 —
Wolfi rolling fixuid 0.6.0-r6 —
Wolfi rolling flannel 0.28.0-r2 —
Wolfi rolling flux-image-automation-controller 1.0.4-r4 —
Wolfi rolling flux-kustomize-controller 1.7.3-r4 —
Wolfi rolling flux-notification-controller 1.7.5-r4 —
Wolfi rolling fluxcd-kustomize-mutating-webhook 0.7.0-r2 —
Wolfi rolling frp +1 0.66.0-r1 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r2 —
Wolfi rolling fzf 0.67.0-r2 —
Wolfi rolling gatus 5.34.0-r1 —
Wolfi rolling ghaudit 0.4.0-r17 —
Wolfi rolling git-credential-oauth 0.17.2-r1 —
Wolfi rolling git-lfs 3.7.1-r3 —
Wolfi rolling git-sync 4.5.1-r1 —
Wolfi rolling gitlab-runner-helper-18.7 +1 18.7.2-r1 —
Wolfi rolling gitleaks 8.30.0-r2 —
Wolfi rolling gitness 3.3.0-r5 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r12 —
Wolfi rolling go-1.20 +3 No fix yet —
Wolfi rolling go-jsonnet 0.21.0-r3 —
Wolfi rolling go-licenses 2.0.1-r3 —
Wolfi rolling go-md2man 2.0.7-r6 —
Wolfi rolling gobuster 3.8.2-r5 —
Wolfi rolling gogatekeeper 4.4.0-r1 —
Wolfi rolling golangci-lint 2.8.0-r1 —
Wolfi rolling goreleaser 2.13.3-r2 —
Wolfi rolling gostatsd 28.3.0-r22 —
Wolfi rolling gosu 1.19-r3 —
Wolfi rolling govulncheck 1.1.4-r6 —
Wolfi rolling gptscript 0.9.8-r1 —
Wolfi rolling grafana-operator 5.21.4-r1 —
Wolfi rolling grafana-rollout-operator 0.33.0-r1 —
Wolfi rolling grpcurl 1.9.3-r10 —
Wolfi rolling guac +4 1.0.1-r4 —
Wolfi rolling harbor-registry 3.0.0-r14 —
Wolfi rolling headlamp 0.39.0-r1 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling helm-docs 1.14.2-r18 —
Wolfi rolling helm-operator 1.42.0-r4 —
Wolfi rolling helm-set-status 0.3.0-r9 —
Wolfi rolling hey 0.1.5-r1 —
Wolfi rolling hivemind 1.1.0-r13 —
Wolfi rolling http-echo 1.0.0-r20 —
Wolfi rolling hubble 1.18.5-r1 —
Wolfi rolling hubble-ui-backend 0.13.3-r4 —
Wolfi rolling hydra 25.4.0-r3 —
Wolfi rolling influx 2.7.5-r13 —
Wolfi rolling ingress-nginx-controller-1.12 1.12.8-r3 —
Wolfi rolling ini-file 1.4.9-r4 —
Wolfi rolling ip-masq-agent 2.12.0-r17 —
Wolfi rolling ipfs-cluster 1.1.5-r1 —
Wolfi rolling jaeger-2-jaeger +6 2.13.0-r3 —
Wolfi rolling juicefs-1.3 1.3.1-r3 —
Wolfi rolling k3d +2 5.8.3-r21 —
Wolfi rolling k3s +2 1.35.0.1-r2 —
Wolfi rolling k8s_gateway 1.6.2-r1 —
Wolfi rolling kapp 0.65.0-r3 —
Wolfi rolling kapp-controller 0.59.1-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kbld 0.47.0-r2 —
Wolfi rolling kine 0.14.11-r0 —
Wolfi rolling kor 0.6.7-r1 —
Wolfi rolling kratos +2 2.9.2-r1 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r19 —
Wolfi rolling ksops 4.4.0-r4 —
Wolfi rolling kube-bench 0.14.1-r1 —
Wolfi rolling kube-logging-operator +1 6.3.2-r1 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r8 —
Wolfi rolling kubecolor 0.5.3-r2 —
Wolfi rolling kubeflow-access-management +1 1.10.0-r11 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.15.0-r7 —
Wolfi rolling kubelet-csr-approver 1.2.12-r2 —
Wolfi rolling kuberay-operator 1.5.1-r2 —
Wolfi rolling kuberlr 0.6.1-r6 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.0-r9 —
Wolfi rolling kubernetes-csi-driver-nfs 4.12.1-r4 —
Wolfi rolling kubernetes-csi-external-attacher 4.10.0-r4 —
Wolfi rolling kubernetes-csi-external-provisioner 6.1.0-r3 —
Wolfi rolling kubernetes-csi-external-resizer 2.0.0-r3 —
Wolfi rolling kubernetes-csi-livenessprobe 2.17.0-r3 —
Wolfi rolling kubernetes-dashboard 7.14.0-r3 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r2 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.2.2-r15 —
Wolfi rolling kubernetes-dns-node-cache 1.26.7-r6 —
Wolfi rolling kubernetes-event-exporter 1.7-r50 —
Wolfi rolling kubernetes-release-go-runner 0.18.0-r7 —
Wolfi rolling kubernetes-replicator 2.12.2-r2 —
Wolfi rolling kubescape-operator 0.2.121-r1 —
Wolfi rolling kubo 0.39.0-r2 —
Wolfi rolling kuma-cp-2.12 +3 2.12.3-r4 —
Wolfi rolling kuma-dp-2.13 +2 2.13.0-r1 —
Wolfi rolling kustomize 5.8.0-r2 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r15 —
Wolfi rolling kyverno-policy-reporter-ui 2.5.1-r1 —
Wolfi rolling langfuse-3 +1 3.149.0-r1 —
Wolfi rolling lazygit 0.58.1-r1 —
Wolfi rolling licenseclassifier 2.0.0-r7 —
Wolfi rolling linkerd2-proxy-init 2.4.4-r1 —
Wolfi rolling litefs 0.5.14-r6 —
Wolfi rolling litestream 0.5.6-r1 —
Wolfi rolling local-path-provisioner 0.0.34-r1 —
Wolfi rolling local-static-provisioner 2.8.0-r7 —
Wolfi rolling lvm-driver 1.8.0-r2 —
Wolfi rolling mage 1.15.0-r19 —
Wolfi rolling manifest-tool 2.2.1-r4 —
Wolfi rolling maru 0.6.0-r7 —
Wolfi rolling mattermost-11.1 11.1.3-r1 —
Wolfi rolling mc 0.20250813.083541-r4 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r7 —
Wolfi rolling metacontroller 4.12.5-r3 —
Wolfi rolling metallb +3 0.15.3-r1 —
Wolfi rolling minio 0.20251015.172955-r3 —
Wolfi rolling minio-object-browser 2.0.4-r4 —
Wolfi rolling minio-operator +1 7.1.1-r8 —
Wolfi rolling mkcert 1.4.4-r20 —
Wolfi rolling mockgen 0.6.0-r3 —
Wolfi rolling mods 1.8.1-r6 —
Wolfi rolling mongodb-kubernetes-operator-version-upgrade-post-start-hook 0.13.0-r6 —
Wolfi rolling nats-server-config-reloader 0.21.1-r1 —
Wolfi rolling nats-top 0.6.3-r12 —
Wolfi rolling nerdctl 2.2.1-r2 —
Wolfi rolling neuvector-sigstore-interface 0_git20251212-r2 —
Wolfi rolling newrelic-fluent-bit-output 3.3.0-r1 —
Wolfi rolling newrelic-infra-operator 0.26.4-r1 —
Wolfi rolling newrelic-nri-statsd 2.12.0-r3 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r28 —
Wolfi rolling nri-cassandra 2.16.1-r1 —
Wolfi rolling nri-couchbase 2.8.4-r1 —
Wolfi rolling nri-haproxy 3.2.4-r1 —
Wolfi rolling nri-jmx 3.11.2-r1 —
Wolfi rolling nri-memcached 2.7.4-r1 —
Wolfi rolling nri-mongodb 2.10.2-r1 —
Wolfi rolling nri-nagios 2.11.4-r1 —
Wolfi rolling nri-nginx 3.6.4-r1 —
Wolfi rolling nri-postgresql 2.23.0-r1 —
Wolfi rolling nri-rabbitmq 2.15.4-r1 —
Wolfi rolling nri-redis 1.12.7-r1 —
Wolfi rolling octo-sts +1 0.5.4-r1 —
Wolfi rolling openbao-k8s 1.4.0-r43 —
Wolfi rolling opencost 1.119.1-r1 —
Wolfi rolling opensearch-k8s-operator 2.8.0-r6 —
Wolfi rolling opentofu-1.9 1.9.4-r5 —
Wolfi rolling osv-scanner 2.3.2-r1 —
Wolfi rolling paranoia 0.5.0-r2 —
Wolfi rolling percona-server-mongodb-operator +1 1.21.2-r1 —
Wolfi rolling petname 2.11-r19 —
Wolfi rolling pg_timetable 6.2.0-r4 —
Wolfi rolling pg_user 1.1.1-r4 —
Wolfi rolling pgpool2_exporter 1.2.2-r10 —
Wolfi rolling podcli 6.9.4-r1 —
Wolfi rolling policy-controller +2 0.14.0-r1 —
Wolfi rolling postgres-operator 1.15.1-r1 —
Wolfi rolling protoc-gen-go 1.36.11-r1 —
Wolfi rolling pvc-autoresizer 0.18.0-r3 —
Wolfi rolling rabbitmq-cluster-operator 2.19.0-r1 —
Wolfi rolling rabbitmq-default-user-credential-updater 1.0.10-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.18.2-r1 —
Wolfi rolling rancher-helm-3 3.19.0-r5 —
Wolfi rolling rancher-loglevel 0.1.6-r10 —
Wolfi rolling rancher-machine 0.15.0.138-r1 —
Wolfi rolling rancher-system-agent 0.3.14-r4 —
Wolfi rolling rancher-system-upgrade-controller 0.18.0-r2 —
Wolfi rolling rancher-telemetry 0.6.2-r8 —
Wolfi rolling ratify +4 1.4.0-r10 —
Wolfi rolling redis-operator 0.23.0-r1 —
Wolfi rolling redka 1.0.1-r0 —
Wolfi rolling restic +1 0.18.1-r4 —
Wolfi rolling runc 1.4.0-r2 —
Wolfi rolling s5cmd 2.3.0-r9 —
Wolfi rolling sbom-convert 0.0.7-r7 —
Wolfi rolling sbom-scorecard 0.0.7-r26 —
Wolfi rolling sbomqs 2.0.3-r2 —
Wolfi rolling scorecard 5.4.0-r3 —
Wolfi rolling sealed-secrets +1 0.34.0-r1 —
Wolfi rolling secrets-store-csi-driver 1.5.5-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r3 —
Wolfi rolling sftpgo-plugin-auth 1.0.13-r3 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.11-r2 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r3 —
Wolfi rolling slsa-verifier 2.7.1-r7 —
Wolfi rolling sonobuoy 0.57.3-r13 —
Wolfi rolling sops 3.11.0-r4 —
Wolfi rolling spark-operator 2.4.0-r3 —
Wolfi rolling spegel 0.6.0-r2 —
Wolfi rolling spire-controller-manager 0.6.3-r4 —
Wolfi rolling spqr 2.9.0-r1 —
Wolfi rolling src 6.12.0-r2 —
Wolfi rolling src-fingerprint 0.19.0-r37 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r1 —
Wolfi rolling stakater-reloader 1.4.12-r1 —
Wolfi rolling steampipe 2.3.4-r1 —
Wolfi rolling step 0.29.0-r1 —
Wolfi rolling step-kms-plugin 0.16.0-r1 —
Wolfi rolling swagger 0.33.1-r4 —
Wolfi rolling temporal-ui-server 2.44.1-r1 —
Wolfi rolling terraform 1.5.7-r37 —
Wolfi rolling terraform-docs 0.21.0-r1 —
Wolfi rolling terraform-mcp-server 0.3.3-r2 —
Wolfi rolling terraform-provider-pagerduty 3.30.9-r1 —
Wolfi rolling terraform-provider-time 0.13.1-r6 —
Wolfi rolling tetra +2 1.6.0-r2 —
Wolfi rolling tfsec 1.28.14-r10 —
Wolfi rolling thanos-operator 0.3.7-r37 —
Wolfi rolling timescaledb-parallel-copy 0.12.0-r1 —
Wolfi rolling timoni 0.25.2-r4 —
Wolfi rolling tofu-controller +1 0.16.0_rc5-r9 —
Wolfi rolling traefik-3.6 3.6.7-r1 —
Wolfi rolling undock 0.11.0-r3 —
Wolfi rolling vale 3.13.0-r4 —
Wolfi rolling vault-benchmark 0.4.0-r3 —
Wolfi rolling vault-k8s 1.7.2-r1 —
Wolfi rolling vault-secrets-webhook 1.22.2-r1 —
Wolfi rolling verticadb-operator 25.4.0.0-r3 —
Wolfi rolling vertical-pod-autoscaler +3 1.5.1-r3 —
Wolfi rolling volume-modifier-for-k8s 0.9.1-r1 —
Wolfi rolling wave 0.10.0-r14 —
Wolfi rolling wazero 1.11.0-r1 —
Wolfi rolling wgcf 2.2.30-r1 —
Wolfi rolling whereabouts 0.9.2-r4 —
Wolfi rolling wire-go 0.7.0-r4 —
Wolfi rolling wuzz 0.5.0-r15 —
Wolfi rolling x509-certificate-exporter 3.19.1-r8 —
Wolfi rolling xcaddy 0.4.5-r4 —
Wolfi rolling xeol 0.10.8-r21 —
Wolfi rolling yace 0.63.0-r4 —
Wolfi rolling ytt 0.52.2-r1 —
Wolfi rolling yunikorn-k8shim 1.7.0-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.24.12 · >= 1.25.0, < 1.25.6 1.24.12, 1.25.6 GO-2026-4339

Advisories 49

References