Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-27143 BIT-golang-2026-27143EUVD-2026-20004GHSA-cfp9-33rc-j74fGO-2026-4868

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Published Apr 8, 2026 · Updated Apr 13, 2026 · Assigned by Go

Vendor: Go toolchain Product: cmd/compile Package: apisix-ingress-controller Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-rollouts Package: atlantis Package: aws-application-networking-k8s Package: blobfuse2 Package: blobfuse2-health-monitor Package: buf Package: cadvisor Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.31-ecr-credential-provider Package: cni-plugins Package: cni-plugins-aws-k8s-compat Package: cni-plugins-bandwidth Package: cni-plugins-bridge Package: cni-plugins-dhcp Package: cni-plugins-dummy Package: cni-plugins-firewall Package: cni-plugins-host-device Package: cni-plugins-host-local Package: cni-plugins-ipam Package: cni-plugins-ipvlan Package: cni-plugins-loopback Package: cni-plugins-macvlan Package: cni-plugins-main Package: cni-plugins-meta Package: cni-plugins-portmap Package: cni-plugins-ptp Package: cni-plugins-sbr Package: cni-plugins-static Package: cni-plugins-tap Package: cni-plugins-tuning Package: cni-plugins-vlan Package: cni-plugins-vrf Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: coredns-1.13 Package: datadog-agent-7.72 Package: datadog-agent-7.72-fakeintake Package: datadog-agent-7.73 Package: datadog-agent-7.73-fakeintake Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: delve Package: dgraph Package: docker-cli Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: envoy-gateway Package: envoy-gateway-egctl Package: external-secrets-operator-1.1 Package: falco-no-driver Package: fuse-overlayfs-snapshotter Package: git-credential-oauth Package: gitaly-18.6 Package: gitaly-backup-18.6 Package: gitaly-init-cgroups-18.6 Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitleaks Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: gofumpt Package: golang Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: grafana-operator Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: helm-3 Package: hey Package: howdy-go Package: http-echo Package: influx Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubectl-1.31 Package: kubectl-1.32 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-argo-rollouts Package: kubelet-1.34 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-csi-external-attacher Package: kuma-coredns-1.13 Package: mage Package: mattermost-11.1 Package: mattermost-11.5 Package: mongo-tools Package: nats-top Package: net-kourier-1.21 Package: newrelic-nri-statsd Package: nri-consul Package: nri-f5 Package: nri-mssql Package: opencost Package: opentelemetry-operator Package: opentelemetry-operator-otel-allocator Package: osv-scanner Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: pvc-autoresizer Package: rancher-agent-2.13 Package: rclone Package: redka Package: regclient-regbot Package: regclient-regctl Package: regclient-regsync Package: renovate Package: rpk-26.1.2 Package: secrets-store-csi-driver-provider-azure Package: snyk-cli Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: tailscale Package: tetra Package: tetragon Package: tetragon-operator Package: tkn Package: toolchain Package: vault-env Package: vault-k8s Package: verticadb-operator Package: wireguard-go Package: xcover Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Affected products

VendorProductAffectedFixed
Go toolchain cmd/compile < 1.25.9, 1.26.0-0 – < 1.26.2 1.25.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.2-1 —
Debian 13 golang-1.24 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +1 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +3 No fix yet —
Ubuntu 22.04 LTS golang-1.20 +5 No fix yet —
Ubuntu 20.04 LTS golang-1.21 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 golang +7 1.25.9-3.el10_1 RHSA-2026:10217
RHEL 9 golang +7 1.25.9-1.el9_7 RHSA-2026:10219
RHEL 8 delve 1.25.2-1.module+el8.10.0+23746+9db33b5e RHSA-2026:10704
RHEL 8 golang +7 1.25.9-1.module+el8.10.0+24226+c418b32c RHSA-2026:10704
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS golang +7 1.25.9-1.el10_0 RHSA-2026:16024
RHEL 9.6 EUS golang +7 1.25.9-1.el9_6 RHSA-2026:16021
RHEL 9.4 E4S golang +6 1.25.9-1.el9_4 RHSA-2026:47712
RHEL 9.2 E4S golang +7 1.25.9-1.el9_2 RHSA-2026:47719
RHEL 8.8 TUS delve 1.26.1-1.module+el8.8.0+24781+86ad105d RHSA-2026:87245
RHEL 8.8 TUS golang +7 1.26.10-4.module+el8.8.0+25113+a148ecc0 RHSA-2026:87245
RHEL 8.8 E4S delve 1.26.1-1.module+el8.8.0+24781+86ad105d RHSA-2026:87245
RHEL 8.8 E4S golang +7 1.26.10-4.module+el8.8.0+25113+a148ecc0 RHSA-2026:87245
RHEL 8.6 EUS Long Life delve 1.26.1-1.module+el8.6.0+24782+a062e766 RHSA-2026:87246
RHEL 8.6 EUS Long Life golang +7 1.26.10-4.module+el8.6.0+25114+90ecdb41 RHSA-2026:87246
RHEL 8.6 AUS delve 1.26.1-1.module+el8.6.0+24782+a062e766 RHSA-2026:87246
RHEL 8.6 AUS golang +7 1.26.10-4.module+el8.6.0+25114+90ecdb41 RHSA-2026:87246
RHEL 8.4 EUS Long Life delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c RHSA-2026:90994
RHEL 8.4 EUS Long Life golang +7 1.26.10-2.module+el8.4.0+25201+9a419e96 RHSA-2026:90994
RHEL 8.4 AUS delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c RHSA-2026:90994
RHEL 8.4 AUS golang +7 1.26.10-2.module+el8.4.0+25201+9a419e96 RHSA-2026:90994
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 delve 1.25.2-1.module_el8.10.0+4074+24330916 ALSA-2026:10704
AlmaLinux 8 golang +7 1.25.9-1.module_el8.10.0+4167+2e2e20dd ALSA-2026:10704

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 golang 1.25.9-3.el10_1 RLSA-2026:10217
Rocky Linux 9 golang 1.25.9-1.el9_7 RLSA-2026:10219
Rocky Linux 8 delve 1.25.2-1.module+el8.10.0+40035+ee0a7047 RLSA-2026:10704
Rocky Linux 8 golang 1.25.9-1.module+el8.10.0+40168+6cb0ea60 RLSA-2026:10704

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP7 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP6 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP6 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES for SAP 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1
SLES for SAP 15 SP6 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP6 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES for SAP 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES for SAP 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES for SAP 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1
SLE HPC 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLE HPC 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLE HPC 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLE HPC 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLE HPC 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLE HPC 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLE HPC 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLE HPC 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.25 1.25.9-1.1 openSUSE-SU-2026:10514-1
openSUSE Tumbleweed go1.26 1.26.2-1.1 openSUSE-SU-2026:10525-1
openSUSE Tumbleweed kpt-cli 1.0.0~beta.64-1.1 openSUSE-SU-2026:10894-1
openSUSE Leap 16.0 go1.25 1.25.9-160000.1.1 openSUSE-SU-2026:20570-1
openSUSE Leap 16.0 go1.25-openssl 1.25.12-160000.1.1 openSUSE-SU-2026:21319-1
openSUSE Leap 16.0 go1.26 1.26.2-160000.1.1 openSUSE-SU-2026:20571-1
openSUSE Leap 16.0 go1.26-openssl 1.26.4-160000.1.1 openSUSE-SU-2026:21254-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.2-r0 —
Alpine v3.24 rclone 1.73.5-r0 —
Alpine v3.23 go 1.25.9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300066.2-2.amzn2023 ALAS2023-2026-1747
Amazon Linux 2023 amazon-ecr-credential-helper 0.12.0-2.amzn2023 ALAS2023-2026-1645
Amazon Linux 2023 containerd +1 2.2.3-1.amzn2023.0.1 ALAS2023-2026-1606
Amazon Linux 2023 credentials-fetcher 2.0.1-1.amzn2023.0.3 ALAS2023-2026-1598
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.4 ALAS2023-2026-1615
Amazon Linux 2023 ecs-init 1.103.0-1.amzn2023 ALAS2023-2026-1637
Amazon Linux 2023 golang +6 1.25.9-1.amzn2023.0.1 ALAS2023-2026-1593
Amazon Linux 2023 golist 0.10.4-12.amzn2023.0.8 ALAS2023-2026-1599
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.1 ALAS2023-2026-1605
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.10 ALAS2023-2026-1660
Amazon Linux 2023 runc 1.3.4-4.amzn2023.0.2 ALAS2023-2026-1661
Amazon Linux 2023 runfinch-finch 1.17.0-1.amzn2023.0.1 ALAS2023-2026-1671
Amazon Linux 2023 soci-snapshotter 0.13.0-1.amzn2023.0.2 ALAS2023-2026-1700
Amazon Linux 2 amazon-cloudwatch-agent 1.300066.2-2.amzn2 ALAS2-2026-3323
Amazon Linux 2 golang +6 1.25.9-1.amzn2.0.1 ALAS2-2026-3259
Amazon Linux 2 golist 0.10.1-10.amzn2.0.12 ALAS2-2026-3260
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.1 ALAS2-2026-3265

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 golang +7 1.25.9-3.el10_1 ELSA-2026-10217
Oracle Linux 9 golang +7 1.25.9-1.el9_7 ELSA-2026-10219
Oracle Linux 8 delve 1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd ELSA-2026-10704
Oracle Linux 8 golang +7 1.25.9-1.module+el8.10.0+90881+305b00ae ELSA-2026-10704

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apisix-ingress-controller 2.0.1-r10 —
Wolfi rolling argo-cd-3.3 3.3.6-r4 —
Wolfi rolling argo-cd-3.3-compat 3.3.7-r0 —
Wolfi rolling argo-rollouts +1 1.9.0-r7 —
Wolfi rolling atlantis 0.42.0-r0 —
Wolfi rolling aws-application-networking-k8s 2.0.2-r8 —
Wolfi rolling blobfuse2 +1 2.4.2-r13 —
Wolfi rolling buf 1.68.3-r0 —
Wolfi rolling cadvisor 0.56.2-r15 —
Wolfi rolling cloud-provider-aws-1.31-ecr-credential-provider +1 1.31.9-r12 —
Wolfi rolling cni-plugins +22 1.9.1-r3 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r13 —
Wolfi rolling coredns-1.13 +1 1.13.2-r4 —
Wolfi rolling delve +1 1.26.2-r0 —
Wolfi rolling dgraph 25.3.2-r0 —
Wolfi rolling docker-cli 29.4.1-r0 —
Wolfi rolling dogstatsd-7.72 +3 7.72.4-r17 —
Wolfi rolling dogstatsd-7.73 +3 7.73.3-r9 —
Wolfi rolling envoy-gateway 1.7.1-r4 —
Wolfi rolling envoy-gateway-egctl 1.7.2-r0 —
Wolfi rolling external-secrets-operator-1.1 1.1.1-r6 —
Wolfi rolling falco-no-driver 0.43.0-r7 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r11 —
Wolfi rolling git-credential-oauth 0.17.2-r4 —
Wolfi rolling gitaly-18.6 +2 18.6.6-r9 —
Wolfi rolling gitlab-kas-18.6 +1 18.6.6-r7 —
Wolfi rolling gitlab-kas-18.7 +2 18.7.6-r1 —
Wolfi rolling gitlab-pages-18.6 18.6.6-r4 —
Wolfi rolling gitleaks 8.30.1-r13 —
Wolfi rolling go-1.24 +7 No fix yet —
Wolfi rolling gofumpt 0.9.2-r7 —
Wolfi rolling grafana-operator 5.22.2-r4 —
Wolfi rolling harbor-2.14 +3 2.14.3-r5 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling hey 0.1.5-r5 —
Wolfi rolling howdy-go 2.3-r1 —
Wolfi rolling http-echo 1.0.0-r24 —
Wolfi rolling influx 2.7.5-r16 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.2-r1 —
Wolfi rolling kube-arangodb-1.4 1.4.1-r14 —
Wolfi rolling kubeadm-1.34 +7 1.34.7-r0 —
Wolfi rolling kubeadm-1.35 +6 1.35.4-r0 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubernetes-csi-external-attacher 4.11.0-r9 —
Wolfi rolling mage 1.17.2-r0 —
Wolfi rolling mattermost-11.1 11.1.3-r3 —
Wolfi rolling mattermost-11.5 11.5.1-r6 —
Wolfi rolling mongo-tools 100.16.0-r2 —
Wolfi rolling nats-top 0.6.4-r3 —
Wolfi rolling net-kourier-1.21 1.21.0-r6 —
Wolfi rolling newrelic-nri-statsd 2.13.0-r2 —
Wolfi rolling nri-consul 2.10.1-r0 —
Wolfi rolling nri-f5 2.10.0-r2 —
Wolfi rolling nri-mssql 2.28.0-r2 —
Wolfi rolling opencost 1.120.0-r0 —
Wolfi rolling opentelemetry-operator +1 0.148.0-r3 —
Wolfi rolling osv-scanner 2.3.5-r1 —
Wolfi rolling percona-server-mongodb-operator +1 1.22.0-r13 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-3.9 3.9.1-r6 —
Wolfi rolling prometheus-operator +2 0.90.1-r3 —
Wolfi rolling pvc-autoresizer 0.20.0-r3 —
Wolfi rolling rancher-agent-2.13 2.13.4-r3 —
Wolfi rolling redka 1.0.1-r1 —
Wolfi rolling regclient-regbot 0.11.2-r4 —
Wolfi rolling regclient-regctl +1 0.11.3-r0 —
Wolfi rolling renovate 43.138.1-r0 —
Wolfi rolling rpk-26.1.2 26.1.2-r1 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.7.2-r13 —
Wolfi rolling snyk-cli 1.1304.0-r0 —
Wolfi rolling spire-agent +2 1.14.5-r0 —
Wolfi rolling tailscale 1.96.4-r1 —
Wolfi rolling tetra +2 1.6.0-r7 —
Wolfi rolling tkn 0.44.1-r2 —
Wolfi rolling vault-env 1.22.1-r9 —
Wolfi rolling vault-k8s 1.7.3-r2 —
Wolfi rolling verticadb-operator 25.4.0.0-r12 —
Wolfi rolling wireguard-go 0.0.20250522-r14 —
Wolfi rolling xcover 0.3.1-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain < 1.25.9 · >= 1.26.0-0, < 1.26.2 1.25.9, 1.26.2 GO-2026-4868

Advisories 50

References