Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-42507 BIT-golang-2026-42507EUVD-2026-34040GHSA-h3gm-q7m7-mp28GO-2026-5039

Arbitrary inputs are included in errors without any escaping in net/textproto

Published Jun 2, 2026 · Updated Jun 3, 2026 · Assigned by Go

Vendor: Go standard library Product: net/textproto Package: aactl Package: act Package: actions-runner-controller Package: addon-resizer Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: amazon-k8s-cni Package: amazon-k8s-cni-init Package: apache-exporter Package: apisix-ingress-controller Package: argo-cd-3.3-compat Package: argo-events Package: argo-rollouts Package: argocd-image-updater Package: atlantis Package: authservice Package: aws-efs-csi-driver Package: aws-flb-cloudwatch Package: aws-flb-kinesis Package: aws-network-policy-agent Package: aws-node-termination-handler Package: aws-nuke Package: azcopy Package: azure-workload-identity-webhook Package: bank-vaults Package: bank-vaults-template Package: bento Package: buildah Package: calico-goldmane-3.31 Package: calico-key-cert-provisioner-3.31 Package: cass-operator Package: cert-exporter Package: cert-manager-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-pdns Package: chisel Package: cis-operator-1.4 Package: cloud-provider-aws-1.36-cloud-controller-manager Package: cloud-provider-aws-1.36-ecr-credential-provider Package: cloud-provider-azure-cloud-controller-manager-1.36 Package: cloud-provider-azure-cloud-node-manager-1.36 Package: cloud-sql-proxy-2.16 Package: cloudnative-pg Package: cloudnative-pg-plugins Package: cluster-api-1.12-clusterctl Package: cluster-api-1.13-capd-manager Package: cluster-api-1.13-clusterctl Package: cluster-api-1.13-controller Package: cluster-api-1.13-kubeadm-bootstrap-controller Package: cluster-api-1.13-kubeadm-control-plane-controller Package: cluster-api-helm-controller Package: cluster-api-ipam-provider-in-cluster Package: cluster-autoscaler-1.35 Package: cluster-proportional-autoscaler Package: conftest Package: conjur-cli Package: consul-k8s-1.9 Package: consul-k8s-1.9-cli Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: containerd-2 Package: containerd-2.3 Package: containerd-shim-runc-v2-2 Package: containerd-stress-2 Package: continuity Package: controller-gen Package: coredns-1.13 Package: coredns-1.14 Package: cortex Package: cri-tools Package: crictl Package: critest Package: croc Package: crossplane-2.2 Package: crossplane-2.2-crank Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-ec2-compat Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-kms Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-memorydb Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-route53 Package: crossplane-provider-aws-route53-compat Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-aws-sqs Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-sql-compat Package: crossplane-provider-azure-storage Package: crossplane-provider-family-aws Package: crossplane-provider-family-azure Package: ctop Package: ctr-2 Package: ctr-2.3 Package: dapr-daprd-1.17 Package: dapr-injector-1.17 Package: dapr-operator-1.17 Package: dapr-placement-1.17 Package: dapr-scheduler-1.17 Package: dapr-sentry-1.17 Package: dask-gateway-server Package: datadog-agent-7.78 Package: datadog-agent-7.78-fakeintake Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.78 Package: db-operator Package: dbmate Package: delve Package: descheduler Package: dgraph Package: docker-cli-buildx Package: docker-credential-acr-env Package: docker-machine-driver-harvester Package: docker-machine-driver-linode Package: dogstatsd-7.78 Package: dynamic-localpv-provisioner Package: emissary Package: emissary-apiext Package: envconsul Package: envoy-gateway Package: envoy-gateway-egctl Package: external-secrets-operator-2.4 Package: falco-no-driver Package: flannel Package: fluent-bit-plugin-loki Package: fluent-operator Package: flux-2.7 Package: flux-image-reflector-controller Package: flux-kustomize-controller Package: flyte Package: frp Package: fuse-overlayfs-snapshotter Package: gatekeeper-3.22 Package: gatekeeper-3.22-gator Package: gatus Package: gitaly-18.11 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.9 Package: gitlab-pages-18.10 Package: gitlab-pages-19.0 Package: gitlab-runner-18.10 Package: gitlab-runner-18.11 Package: gitlab-runner-18.9 Package: gitlab-runner-19.0 Package: gitlab-runner-helper-18.10 Package: gitlab-runner-helper-18.11 Package: gitlab-runner-helper-18.9 Package: gke-gcloud-auth-plugin Package: glab Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: gogatekeeper Package: golang Package: golang-1.19 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.26 Package: golangci-lint Package: gomplate-5 Package: goreleaser Package: gostatsd Package: govulncheck Package: grafana-12.3 Package: grafana-13.0 Package: grafana-alloy Package: grafana-mimir-3.0 Package: grafana-operator Package: grafana-rollout-operator Package: guac Package: guaccsub Package: guacone Package: haproxy-ingress-0.16 Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: harbor-registry Package: harbor-scanner-trivy Package: hcloud Package: health-checker-1.35 Package: helm-3 Package: helm-4 Package: helm-push Package: hubble Package: hubble-ui-backend Package: ingress-nginx-controller-1.15 Package: ingress-nginx-custom-error-pages-1.15 Package: istio-install-cni-1.29 Package: istio-pilot-agent-1.29 Package: istio-pilot-discovery-1.29 Package: istioctl-1.29 Package: jaeger-operator Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-syncctl Package: k3s-1.32 Package: k3s-multicall-1.32 Package: k3s-multicall-1.35 Package: k3s-static-1.32 Package: k3s-static-1.35 Package: k9s Package: kaniko Package: kapp-controller Package: karpenter-1.11 Package: katib-controller Package: katib-db-manager Package: katib-file-metricscollector Package: kbld Package: kiali Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-webhook Package: knative-serving-1.21-activator Package: knative-serving-1.21-autoscaler Package: knative-serving-1.21-autoscaler-hpa Package: knative-serving-1.21-cleanup Package: knative-serving-1.21-controller Package: knative-serving-1.21-queue Package: knative-serving-1.21-webhook Package: kots Package: kserve-agent Package: kserve-localmodel Package: kserve-manager Package: kserve-qpext Package: kserve-router Package: ksops Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-bench Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-logging-operator-custom-runner Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kube-state-metrics Package: kube-vip Package: kube-webhook-certgen-1.15 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-argo-rollouts Package: kubectl-bash-completion-1.35 Package: kubeflow-access-management Package: kubeflow-admission-webhook Package: kubeflow-notebook-controller Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubeflow-pvcviewer-controller Package: kubeflow-tensorboard-controller Package: kubelet-1.35 Package: kubelet-1.36 Package: kuberay-operator Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-livenessprobe Package: kubernetes-csi-node-driver-registrar-2.17 Package: kubernetes-event-exporter Package: kubernetes-pause-compat-1.35 Package: kubernetes-replicator Package: kubescape Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubo Package: kuma-cni-2.12 Package: kuma-cni-2.13 Package: kuma-coredns-1.13 Package: kuma-coredns-1.14 Package: kuma-cp-2.12 Package: kuma-cp-2.13 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kuma-install-cni-2.12 Package: kuma-install-cni-2.13 Package: kumactl-2.12 Package: kumactl-2.13 Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-init-container-1.17 Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-readiness-checker-1.17 Package: kyverno-reports-controller-1.17 Package: lazydocker Package: libnvidia-container Package: litefs Package: litestream Package: local-path-provisioner Package: log-counter-1.35 Package: manifest-tool Package: mattermost-11.1 Package: mattermost-11.5 Package: metallb Package: metallb-controller Package: metallb-frr Package: metallb-frr-compat Package: metallb-speaker Package: metrics-server Package: migrate Package: mongo-tools Package: multus-cni Package: net-kourier-1.22 Package: neuvector-dbgen Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-infra-operator Package: newrelic-nri-kube-events Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: node-problem-detector-1.35 Package: nova Package: nri-apache Package: nri-consul Package: nri-couchbase Package: nri-discovery-kubernetes Package: nri-elasticsearch Package: nri-haproxy Package: nri-kubernetes Package: nri-mssql Package: nri-prometheus Package: octo-sts Package: octo-sts-webhook Package: omnibump Package: op-geth Package: op-geth-abigen Package: op-geth-clef Package: op-geth-devp2p Package: op-geth-evm Package: opa Package: opa-envoy Package: opentofu-1.11 Package: opentofu-1.12 Package: osv-scanner Package: paranoia Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: pgpool2_exporter Package: pinact Package: podcli Package: podinfo Package: polaris Package: policy-controller Package: policy-controller-tester Package: prometheus-3.11 Package: prometheus-3.12 Package: prometheus-3.8 Package: prometheus-adapter Package: promxy Package: pulumi-kubernetes-operator Package: pulumi-language-java Package: q Package: rabbitmq-cluster-operator Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-helm-3 Package: rancher-webhook-0.10 Package: redka Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: rook-1.19 Package: rook-1.19-oci-compat Package: rpk-26.1.9 Package: runc Package: sealed-secrets Package: sealed-secrets-kubeseal Package: secrets-store-csi-driver Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-server Package: skopeo Package: slsa-verifier Package: snyk-cli Package: sops Package: spark-operator Package: speedtest-go Package: spicedb-operator Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: spqr Package: src Package: src-fingerprint Package: stakater-reloader Package: stdlib Package: steampipe Package: step-ca Package: step-issuer Package: tdbg Package: tekton-chains Package: tekton-pipelines-controller-1.12 Package: tekton-pipelines-controller-1.13 Package: tekton-pipelines-entrypoint-1.12 Package: tekton-pipelines-entrypoint-1.13 Package: tekton-pipelines-events-1.12 Package: tekton-pipelines-events-1.13 Package: tekton-pipelines-resolvers-1.11 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-resolvers-1.13 Package: tekton-pipelines-sidecarlogresults-1.12 Package: tekton-pipelines-sidecarlogresults-1.13 Package: tekton-pipelines-webhook-1.11 Package: tekton-pipelines-webhook-1.12 Package: tekton-pipelines-webhook-1.13 Package: telegraf-1.38 Package: temporal Package: temporal-cassandra-tool Package: temporal-elasticsearch-tool Package: temporal-server Package: temporal-sql-tool Package: temporal-ui-server Package: terraform-docs Package: terraform-provider-acme Package: terraform-provider-azurerm Package: terraform-provider-grafana Package: terragrunt Package: tetra Package: tetragon Package: tetragon-operator Package: timoni Package: tofu-controller Package: tofu-controller-runner Package: traefik-3.7 Package: trino Package: trufflehog Package: vault-benchmark Package: vault-k8s Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: velero-plugin-for-aws Package: velero-plugin-for-aws-compat Package: velero-plugin-for-csi Package: velero-plugin-for-microsoft-azure Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: victoriametrics-vmagent-cluster Package: victoriametrics-vmalert-cluster Package: victoriametrics-vminsert-cluster Package: victoriametrics-vmselect-cluster Package: victoriametrics-vmstorage-cluster Package: volume-modifier-for-k8s Package: witness Package: wuzz Package: xeol Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Affected products

VendorProductAffectedFixed
Go standard library net/textproto < 1.25.11, 1.26.0-0 – < 1.26.4 1.25.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.4-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-1.26 No fix yet —
Ubuntu 26.04 LTS golang-1.24 +2 No fix yet —
Ubuntu 25.10 golang-1.24 +1 No fix yet —
Ubuntu 24.04 LTS golang-1.24 +2 No fix yet —
Ubuntu 22.04 LTS golang-1.24 +2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 golang +7 1.26.4-1.el10_2 RHSA-2026:29980
RHEL 9 git-lfs 3.7.1-4.el9_8.3 RHSA-2026:66364
RHEL 9 golang +7 1.26.4-1.el9_8 RHSA-2026:29981
RHEL 8 delve 1.26.1-1.module+el8.10.0+24516+40554724 RHSA-2026:38995
RHEL 8 golang +7 1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS golang +7 1.26.5-1.el10_0 RHSA-2026:49702
RHEL 9.6 EUS golang +7 1.26.5-1.el9_6 RHSA-2026:49712
RHEL 9.4 E4S golang +7 1.26.5-1.el9_4 RHSA-2026:57649
RHEL 9.2 E4S golang +7 1.26.5-1.el9_2 RHSA-2026:61253
Red Hat Hardened Images 1 golang1.25 +5 1.25.11-2.hum1 RHSA-2026:23262
Red Hat Hardened Images 1 golang1.26 +5 1.26.4-2.hum1 RHSA-2026:23264

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 golang +7 1.26.4-1.el10_2.alma.1 ALSA-2026:29980
AlmaLinux 9 git-lfs 3.7.1-4.el9_8.3 ALSA-2026:66364
AlmaLinux 9 golang +7 1.26.4-1.el9_8 ALSA-2026:29981
AlmaLinux 8 delve 1.26.1-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995
AlmaLinux 8 golang +7 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 golang 1.26.4-1.el10_2 RLSA-2026:29980
Rocky Linux 9 golang 1.26.4-1.el9_8 RLSA-2026:29981

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES 15 SP7 go1.25-openssl 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1
SLES 15 SP7 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES 15 SP7 go1.26-openssl 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1
SLES 15 SP6 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES 15 SP6 go1.25-openssl 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1
SLES 15 SP6 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES 15 SP6 go1.26-openssl 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1
SLES 15 SP5 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES 15 SP5 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLES 15 SP5 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES 15 SP5 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1
SLES 15 SP4 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES 15 SP4 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLES 15 SP4 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES 15 SP4 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.25 1.25.11-160000.1.1 SUSE-SU-2026:22155-1
SLES for SAP 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES for SAP 16.0 go1.26 +1 1.26.4-160000.1.1 SUSE-SU-2026:22572-1, SUSE-SU-2026:22154-1
SLES for SAP 15 SP6 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1
SLES for SAP 15 SP6 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES for SAP 15 SP6 go1.26-openssl 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1
SLES for SAP 15 SP5 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLES for SAP 15 SP5 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1
SLES for SAP 15 SP4 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLES for SAP 15 SP4 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1
SLES 16.0 go1.25 1.25.11-160000.1.1 SUSE-SU-2026:22155-1
SLES 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES 16.0 go1.26 +1 1.26.4-160000.1.1 SUSE-SU-2026:22572-1, SUSE-SU-2026:22154-1
SLE HPC 15 SP5 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLE HPC 15 SP5 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLE HPC 15 SP5 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLE HPC 15 SP5 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1
SLE HPC 15 SP4 go1.25 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1
SLE HPC 15 SP4 go1.25-openssl 1.25.12-150000.1.27.1 SUSE-SU-2026:3046-1
SLE HPC 15 SP4 go1.26 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1
SLE HPC 15 SP4 go1.26-openssl 1.26.5-150000.1.12.1 SUSE-SU-2026:3047-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.25 1.25.11-1.1 openSUSE-SU-2026:10959-1
openSUSE Tumbleweed go1.26 1.26.4-1.1 openSUSE-SU-2026:10960-1
openSUSE Tumbleweed rclone 1.74.3-1.1 openSUSE-SU-2026:10975-1
openSUSE Leap 16.0 go1.25 1.25.11-160000.1.1 openSUSE-SU-2026:20977-1
openSUSE Leap 16.0 go1.25-openssl 1.25.12-160000.1.1 openSUSE-SU-2026:21319-1
openSUSE Leap 16.0 go1.26 +1 1.26.4-160000.1.1 openSUSE-SU-2026:21254-1, openSUSE-SU-2026:20976-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 rclone 1.74.4-bp160.1.1 openSUSE-SU-2026:21436-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.8-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300069.1-1.amzn2023 ALAS2023-2026-2025
Amazon Linux 2023 containerd +1 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909
Amazon Linux 2023 credentials-fetcher 2.0.3-1.amzn2023.0.1 ALAS2023-2026-1885
Amazon Linux 2023 docker 25.0.16-1.amzn2023.0.3 ALAS2023-2026-1901
Amazon Linux 2023 ecs-init 1.105.0-1.amzn2023 ALAS2023-2026-1902
Amazon Linux 2023 golang +6 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878
Amazon Linux 2023 golang-github-burntsushi-toml +1 1.5.0-1.amzn2023.0.2 ALAS2023-2026-1877
Amazon Linux 2023 golang-github-burntsushi-toml-test +1 0.2.0-8.amzn2023.0.4 ALAS2023-2026-1876
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875
Amazon Linux 2023 golist 0.10.4-12.amzn2023.0.10 ALAS2023-2026-1874
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.4 ALAS2023-2026-1908
Amazon Linux 2023 runc 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138
Amazon Linux 2023 soci-snapshotter 0.14.1-1.amzn2023.0.1 ALAS2023-2026-1884
Amazon Linux 2 amazon-cloudwatch-agent 1.300069.1-1.amzn2 ALAS2-2026-3844
Amazon Linux 2 golang +6 1.25.11-1.amzn2.0.1 ALAS2-2026-3383
Amazon Linux 2 golist 0.10.1-10.amzn2.0.14 ALAS2-2026-3382
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.4 ALAS2-2026-3497

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang 1.25.11-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 golang +7 1.26.5-1.0.1.el10_2 ELSA-2026-29980
Oracle Linux 9 golang +7 1.26.4-1.0.1.el9_8 ELSA-2026-29981

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r54 —
Wolfi rolling act 0.2.89-r1 —
Wolfi rolling actions-runner-controller 0.14.2-r2 —
Wolfi rolling addon-resizer 1.8.23-r20 —
Wolfi rolling amazon-cloudwatch-agent 1.300069.0-r2 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.5.0-r0 —
Wolfi rolling amazon-k8s-cni +2 1.22.1-r1 —
Wolfi rolling apache-exporter 1.0.12-r7 —
Wolfi rolling apisix-ingress-controller 2.1.0-r1 —
Wolfi rolling argo-cd-3.3-compat 3.3.14-r9 —
Wolfi rolling argo-events 1.9.10-r25 —
Wolfi rolling argo-rollouts +1 1.9.0-r15 —
Wolfi rolling argocd-image-updater 1.2.1-r2 —
Wolfi rolling atlantis 0.43.0-r5 —
Wolfi rolling authservice 1.1.5-r10 —
Wolfi rolling aws-efs-csi-driver 3.2.0-r2 —
Wolfi rolling aws-flb-cloudwatch 1.9.5-r3 —
Wolfi rolling aws-flb-kinesis 1.10.4-r3 —
Wolfi rolling aws-network-policy-agent 1.3.5-r2 —
Wolfi rolling aws-node-termination-handler 1.25.6-r10 —
Wolfi rolling aws-nuke 3.65.0-r1 —
Wolfi rolling azcopy 10.32.4-r3 —
Wolfi rolling azure-workload-identity-webhook 1.5.1-r21 —
Wolfi rolling bank-vaults +1 1.33.1-r2 —
Wolfi rolling bento 1.18.0-r2 —
Wolfi rolling buildah 1.44.0-r1 —
Wolfi rolling calico-goldmane-3.31 +1 3.31.7-r3 —
Wolfi rolling cass-operator 1.31.0-r1 —
Wolfi rolling cert-exporter 2.18.0-r10 —
Wolfi rolling cert-manager-1.20 +3 1.20.2-r8 —
Wolfi rolling cert-manager-webhook-pdns 2.5.5-r11 —
Wolfi rolling chisel 1.11.5-r6 —
Wolfi rolling cis-operator-1.4 1.4.8-r8 —
Wolfi rolling cloud-provider-aws-1.36-ecr-credential-provider +1 1.36.0-r3 —
Wolfi rolling cloud-sql-proxy-2.16 2.16.0-r24 —
Wolfi rolling cloudnative-pg +1 1.29.1-r4 —
Wolfi rolling cluster-api-1.12-clusterctl 1.12.11-r5 —
Wolfi rolling cluster-api-1.13-clusterctl +4 1.13.2-r3 —
Wolfi rolling cluster-api-helm-controller 0.6.4-r5 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.0-r6 —
Wolfi rolling cluster-autoscaler-1.35 1.35.0-r8 —
Wolfi rolling cluster-proportional-autoscaler 1.10.3-r9 —
Wolfi rolling conftest 0.68.2-r4 —
Wolfi rolling conjur-cli 9.2.2-r0 —
Wolfi rolling consul-k8s-1.9 +1 1.9.8-r3 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r18 —
Wolfi rolling continuity 0.6.0-r0 —
Wolfi rolling controller-gen 0.21.0-r2 —
Wolfi rolling coredns-1.13 +1 1.13.2-r5 —
Wolfi rolling coredns-1.14 +1 1.14.3-r4 —
Wolfi rolling cortex 1.21.1-r0 —
Wolfi rolling crictl +2 1.36.0-r4 —
Wolfi rolling croc 10.4.4-r1 —
Wolfi rolling crossplane-2.2 +1 2.2.2-r1 —
Wolfi rolling crossplane-provider-aws-ec2-compat +2 2.7.0-r6 —
Wolfi rolling crossplane-provider-aws-kms +4 2.5.0-r11 —
Wolfi rolling crossplane-provider-aws-lambda +2 2.5.0-r9 —
Wolfi rolling crossplane-provider-aws-s3 +8 2.5.0-r10 —
Wolfi rolling crossplane-provider-azure-authorization 2.5.0-r14 —
Wolfi rolling crossplane-provider-azure-managedidentity 2.5.0-r13 —
Wolfi rolling crossplane-provider-azure-sql +1 2.5.0-r12 —
Wolfi rolling crossplane-provider-family-aws 2.5.0-r8 —
Wolfi rolling ctop 0.7.7-r36 —
Wolfi rolling ctr-2 +5 2.3.1-r2 —
Wolfi rolling dapr-daprd-1.17 +5 1.17.9-r1 —
Wolfi rolling dask-gateway-server 2026.3.0-r7 —
Wolfi rolling db-operator 2.16.0-r14 —
Wolfi rolling dbmate 2.33.0-r3 —
Wolfi rolling delve 1.26.3-r4 —
Wolfi rolling descheduler +1 0.36.0-r3 —
Wolfi rolling dgraph 25.3.4-r1 —
Wolfi rolling docker-cli-buildx 0.34.1-r4 —
Wolfi rolling docker-credential-acr-env 0.7.0-r33 —
Wolfi rolling docker-machine-driver-harvester 1.0.6-r12 —
Wolfi rolling docker-machine-driver-linode 0.1.16-r6 —
Wolfi rolling dogstatsd-7.78 +4 7.78.4-r4 —
Wolfi rolling dynamic-localpv-provisioner 4.5.0-r2 —
Wolfi rolling emissary +1 4.1.0-r2 —
Wolfi rolling envconsul 0.13.4-r15 —
Wolfi rolling envoy-gateway +1 1.8.0-r3 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r8 —
Wolfi rolling falco-no-driver 0.44.1-r5 —
Wolfi rolling flannel 0.28.4-r5 —
Wolfi rolling fluent-bit-plugin-loki 3.7.2-r3 —
Wolfi rolling fluent-operator 3.8.0-r1 —
Wolfi rolling flux-2.7 2.7.5-r22 —
Wolfi rolling flux-image-reflector-controller 1.1.2-r3 —
Wolfi rolling flux-kustomize-controller 1.8.5-r5 —
Wolfi rolling flyte 1.16.7-r1 —
Wolfi rolling frp 0.69.1-r1 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r16 —
Wolfi rolling gatekeeper-3.22 +1 3.22.2-r4 —
Wolfi rolling gatus 5.36.0-r3 —
Wolfi rolling gitaly-18.11 18.11.4-r4 —
Wolfi rolling gitlab-pages-18.10 18.10.7-r2 —
Wolfi rolling gitlab-pages-19.0 19.0.1-r3 —
Wolfi rolling gitlab-runner-18.10 +2 18.10.1-r12 —
Wolfi rolling gitlab-runner-18.11 +2 18.11.3-r5 —
Wolfi rolling gitlab-runner-18.9 +2 18.9.0-r15 —
Wolfi rolling gitlab-runner-19.0 19.0.1-r1 —
Wolfi rolling gke-gcloud-auth-plugin 36.0.0-r3 —
Wolfi rolling glab 1.101.0-r2 —
Wolfi rolling go-1.24 +6 No fix yet —
Wolfi rolling go-1.26 1.26.4-r0 —
Wolfi rolling gogatekeeper 4.9.0-r3 —
Wolfi rolling golangci-lint 2.12.2-r4 —
Wolfi rolling gomplate-5 5.1.0-r7 —
Wolfi rolling goreleaser 2.16.0-r2 —
Wolfi rolling gostatsd 28.3.0-r33 —
Wolfi rolling govulncheck 1.4.0-r0 —
Wolfi rolling grafana-12.3 12.3.6.04-r2 —
Wolfi rolling grafana-13.0 13.0.2-r0 —
Wolfi rolling grafana-alloy 1.16.2-r1 —
Wolfi rolling grafana-mimir-3.0 3.0.9-r4 —
Wolfi rolling grafana-operator 5.22.2-r8 —
Wolfi rolling grafana-rollout-operator 0.37.0-r2 —
Wolfi rolling guac +2 1.1.0-r14 —
Wolfi rolling harbor-2.14 +3 2.14.4-r1 —
Wolfi rolling harbor-registry 3.1.1-r4 —
Wolfi rolling hcloud 1.65.0-r3 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling helm-4 +1 4.2.0-r1 —
Wolfi rolling helm-push 0.11.1-r14 —
Wolfi rolling hubble 1.19.3-r7 —
Wolfi rolling hubble-ui-backend 0.13.5-r5 —
Wolfi rolling istioctl-1.29 +3 1.29.3-r3 —
Wolfi rolling jaeger-operator 1.65.0-r21 —
Wolfi rolling jitsucom-bulker-ingmgr +2 2.11.913-r30 —
Wolfi rolling k3s-1.32 +2 1.32.13.1-r20 —
Wolfi rolling k3s-static-1.35 +1 1.35.3.1-r14 —
Wolfi rolling k9s 0.50.18-r29 —
Wolfi rolling kaniko 1.25.15-r5 —
Wolfi rolling kapp-controller 0.60.1-r1 —
Wolfi rolling karpenter-1.11 1.11.1-r5 —
Wolfi rolling katib-controller +2 0.19.0-r18 —
Wolfi rolling kbld 0.48.1-r1 —
Wolfi rolling kiali 2.27.0-r1 —
Wolfi rolling knative-eventing-1.21-jobsink +1 1.21.4-r10 —
Wolfi rolling knative-serving-1.21-queue +6 1.21.2-r9 —
Wolfi rolling kots 1.130.4-r6 —
Wolfi rolling kserve-agent +4 0.18.0-r5 —
Wolfi rolling ksops 4.5.1-r6 —
Wolfi rolling kube-bench 0.15.0-r12 —
Wolfi rolling kube-fluentd-operator 1.18.2-r66 —
Wolfi rolling kube-logging-operator 6.6.0-r1 —
Wolfi rolling kube-logging-operator-config-reloader 6.5.2-r1 —
Wolfi rolling kube-logging-operator-custom-runner 0.16.0-r3 —
Wolfi rolling kube-state-metrics 2.19.0-r3 —
Wolfi rolling kube-vip 1.2.0-r1 —
Wolfi rolling kube-webhook-certgen-1.15 +2 1.15.6-r1 —
Wolfi rolling kubeadm-1.35 +7 1.35.5-r2 —
Wolfi rolling kubeadm-1.36 +9 1.36.1-r2 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubectl-1.33 1.33.12-r2 —
Wolfi rolling kubectl-bash-completion-1.35 +3 1.35.8-r6 —
Wolfi rolling kubeflow-access-management +5 1.10.0-r25 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.16.1-r5 —
Wolfi rolling kubeflow-pipelines-metadata-writer-compat 2.17.2-r4 —
Wolfi rolling kuberay-operator 1.6.1-r5 —
Wolfi rolling kubernetes-csi-external-provisioner 6.3.0-r0 —
Wolfi rolling kubernetes-csi-livenessprobe 2.19.0-r1 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.17 2.17.0-r1 —
Wolfi rolling kubernetes-event-exporter 1.7-r63 —
Wolfi rolling kubernetes-replicator 2.12.3-r8 —
Wolfi rolling kubescape 4.0.9-r1 —
Wolfi rolling kubescape-operator 0.2.148-r1 —
Wolfi rolling kubevela-vela-cli +1 1.10.8-r10 —
Wolfi rolling kubo 0.41.0-r4 —
Wolfi rolling kuma-cp-2.12 +4 2.12.3-r16 —
Wolfi rolling kuma-cp-2.13 +4 2.13.7-r1 —
Wolfi rolling kyverno-1.17 1.17.2-r35 —
Wolfi rolling kyverno-cli-1.17 +5 1.17.2-r10 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r29 —
Wolfi rolling lazydocker 0.25.2-r4 —
Wolfi rolling libnvidia-container 1.19.0-r3 —
Wolfi rolling litefs 0.5.14-r12 —
Wolfi rolling litestream 0.5.11-r7 —
Wolfi rolling local-path-provisioner 0.0.36-r2 —
Wolfi rolling log-counter-1.35 +2 1.35.2-r15 —
Wolfi rolling manifest-tool 2.2.2-r3 —
Wolfi rolling mattermost-11.1 11.1.3-r3 —
Wolfi rolling mattermost-11.5 11.5.7-r1 —
Wolfi rolling metallb +5 0.16.1-r1 —
Wolfi rolling metrics-server 0.8.1-r10 —
Wolfi rolling migrate 4.19.1-r17 —
Wolfi rolling mongo-tools 100.17.0-r4 —
Wolfi rolling multus-cni 4.2.4-r12 —
Wolfi rolling neuvector-dbgen 0_git20260529-r1 —
Wolfi rolling neuvector-scanner +1 4.185-r0 —
Wolfi rolling newrelic-infra-operator 0.27.2-r4 —
Wolfi rolling newrelic-nri-kube-events 2.19.3-r4 —
Wolfi rolling newrelic-nri-statsd 2.14.0-r1 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r42 —
Wolfi rolling nova 3.12.0-r3 —
Wolfi rolling nri-apache 1.17.1-r2 —
Wolfi rolling nri-consul 2.11.2-r1 —
Wolfi rolling nri-couchbase 2.11.0-r3 —
Wolfi rolling nri-discovery-kubernetes 1.14.3-r2 —
Wolfi rolling nri-elasticsearch 6.3.0-r2 —
Wolfi rolling nri-haproxy 3.4.1-r3 —
Wolfi rolling nri-mssql 2.30.0-r3 —
Wolfi rolling nri-prometheus 2.29.1-r2 —
Wolfi rolling octo-sts +1 0.7.2-r1 —
Wolfi rolling omnibump 0.13.0-r0 —
Wolfi rolling op-geth +4 1.101702.2-r2 —
Wolfi rolling opa 1.17.0-r2 —
Wolfi rolling opa-envoy 1.17.0-r1 —
Wolfi rolling opentofu-1.11 1.11.8-r3 —
Wolfi rolling opentofu-1.12 1.12.1-r1 —
Wolfi rolling osv-scanner 2.3.8-r6 —
Wolfi rolling paranoia 0.5.0-r12 —
Wolfi rolling percona-server-mongodb-operator +1 1.22.0-r18 —
Wolfi rolling pgpool2_exporter 1.2.2-r23 —
Wolfi rolling pinact 4.0.0-r2 —
Wolfi rolling podcli +1 6.12.0-r3 —
Wolfi rolling polaris 10.2.0-r5 —
Wolfi rolling policy-controller +1 0.15.1-r9 —
Wolfi rolling prometheus-3.11 3.11.3-r6 —
Wolfi rolling prometheus-3.12 3.12.0-r1 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-adapter 0.12.0-r28 —
Wolfi rolling promxy 0.0.93-r19 —
Wolfi rolling pulumi-kubernetes-operator 2.7.0-r9 —
Wolfi rolling pulumi-language-java 1.28.0-r3 —
Wolfi rolling q 0.19.12-r10 —
Wolfi rolling rabbitmq-cluster-operator 2.21.0-r3 —
Wolfi rolling rancher-2.14 2.14.1-r4 —
Wolfi rolling rancher-agent-2.13 2.13.9-r4 —
Wolfi rolling rancher-fleet-cli +2 0.15.2-r2 —
Wolfi rolling rancher-helm-3 3.20.0-r14 —
Wolfi rolling rancher-webhook-0.10 0.10.5-r2 —
Wolfi rolling redka 1.0.1-r3 —
Wolfi rolling rekor-cli +2 1.5.2-r1 —
Wolfi rolling rook-1.19 +1 1.19.6-r1 —
Wolfi rolling rpk-26.1.9 26.1.9-r2 —
Wolfi rolling runc 1.4.2-r5 —
Wolfi rolling sealed-secrets +1 0.37.0-r4 —
Wolfi rolling secrets-store-csi-driver 1.6.0-r3 —
Wolfi rolling sftpgo-plugin-auth 1.0.16-r0 —
Wolfi rolling sftpgo-plugin-eventstore 1.0.24-r1 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.13-r1 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.17-r1 —
Wolfi rolling sigstore-scaffolding-tuf-server +4 0.7.31-r16 —
Wolfi rolling skopeo 1.23.0-r1 —
Wolfi rolling slsa-verifier 2.7.1-r18 —
Wolfi rolling snyk-cli 1.1304.3-r6 —
Wolfi rolling sops 3.13.1-r2 —
Wolfi rolling spark-operator 2.5.0-r4 —
Wolfi rolling speedtest-go 1.7.10-r13 —
Wolfi rolling spicedb-operator 1.25.1-r2 —
Wolfi rolling spire-agent +2 1.15.1-r1 —
Wolfi rolling spqr 2.9.9-r2 —
Wolfi rolling src 7.3.0-r3 —
Wolfi rolling src-fingerprint 0.19.0-r54 —
Wolfi rolling stakater-reloader 1.4.17-r2 —
Wolfi rolling steampipe 2.4.4-r3 —
Wolfi rolling step-ca 0.30.2-r10 —
Wolfi rolling step-issuer 0.10.2-r16 —
Wolfi rolling tdbg +4 1.31.0-r3 —
Wolfi rolling tekton-chains 0.27.0-r1 —
Wolfi rolling tekton-pipelines-events-1.12 +5 1.12.0-r6 —
Wolfi rolling tekton-pipelines-events-1.13 +5 1.13.0-r1 —
Wolfi rolling tekton-pipelines-webhook-1.11 +1 1.11.1-r20 —
Wolfi rolling telegraf-1.38 1.38.4-r6 —
Wolfi rolling temporal 1.7.1-r1 —
Wolfi rolling temporal-ui-server 2.50.0-r2 —
Wolfi rolling terraform-docs 0.24.0-r3 —
Wolfi rolling terraform-provider-acme 2.48.1-r5 —
Wolfi rolling terraform-provider-azurerm 4.75.0-r1 —
Wolfi rolling terraform-provider-grafana 4.37.0-r0 —
Wolfi rolling terragrunt 1.0.5-r4 —
Wolfi rolling tetra +2 1.7.0-r1 —
Wolfi rolling timoni 0.26.0-r13 —
Wolfi rolling tofu-controller +1 0.16.3-r3 —
Wolfi rolling traefik-3.7 3.7.1-r4 —
Wolfi rolling trino 481-r2 —
Wolfi rolling trufflehog 3.95.5-r1 —
Wolfi rolling vault-benchmark 0.4.0-r19 —
Wolfi rolling vault-k8s 1.7.4-r3 —
Wolfi rolling vcluster +2 0.34.2-r0 —
Wolfi rolling velero-plugin-for-aws +2 1.14.1-r2 —
Wolfi rolling velero-plugin-for-csi 0.7.1-r51 —
Wolfi rolling vertical-pod-autoscaler +2 1.6.0-r12 —
Wolfi rolling victoriametrics-vmagent-cluster +4 1.145.0-r0 —
Wolfi rolling volume-modifier-for-k8s 0.9.5-r1 —
Wolfi rolling witness 0.11.0-r7 —
Wolfi rolling wuzz 0.5.0-r26 —
Wolfi rolling xeol 0.10.8-r44 —
Wolfi rolling zarf 0.77.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.25.11 · >= 1.26.0-0, < 1.26.4 1.25.11, 1.26.4 GO-2026-5039

Advisories 50

References