Description
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go toolchain | cmd/go | < 1.26.9, 1.27.0-0 – < 1.27.2 | 1.26.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-1.26 | 1.26.9-1 | — |
| Debian 14 | golang-1.27 | 1.27.2-1 | — |
| Debian 13 | golang-1.24 | No fix yet | — |
| Debian 12 | golang-1.19 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-1.26 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | golang-1.23 +3 | No fix yet | — |
| Ubuntu 24.04 LTS | golang-1.21 +5 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-1.18 +7 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-1.13 +5 | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | golang-1.16 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | golang-1.13 +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | golang-1.13 +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | golang1.26 +5 | 1.26.9-0.1.hum1 | RHSA-2026:79720 |
| Red Hat Hardened Images 1 | golang1.27 +5 | 1.27.2-0.1.hum1 | RHSA-2026:79715 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | golang +7 | 1.26.10-1.el10_2.alma.1 | ALSA-2026:86093 |
| AlmaLinux 9 | golang +7 | 1.26.10-1.el9_8 | ALSA-2026:86196 |
| AlmaLinux 8 | delve | 1.26.1-1.module_el8.10.0+4307+6e4cbc60 | ALSA-2026:86203 |
| AlmaLinux 8 | golang +7 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | ALSA-2026:86203 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES 15 SP7 | go1.26-openssl | 1.26.10-150600.13.18.1 | SUSE-SU-2026:4866-1 |
| SLES 15 SP7 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES 15 SP6 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES 15 SP6 | go1.26-openssl | 1.26.10-150600.13.18.1 | SUSE-SU-2026:4866-1 |
| SLES 15 SP6 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES 15 SP5 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES 15 SP5 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLES 15 SP5 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES 15 SP4 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES 15 SP4 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLES 15 SP4 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | go1.26 | 1.26.9-160000.1.1 | SUSE-SU-2026:24239-1 |
| SLES for SAP 16.0 | go1.27 | 1.27.2-160000.1.1 | SUSE-SU-2026:24237-1 |
| SLES for SAP 15 SP6 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES for SAP 15 SP6 | go1.26-openssl | 1.26.10-150600.13.18.1 | SUSE-SU-2026:4866-1 |
| SLES for SAP 15 SP6 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES for SAP 15 SP5 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES for SAP 15 SP5 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLES for SAP 15 SP5 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES for SAP 15 SP4 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLES for SAP 15 SP4 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLES for SAP 15 SP4 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLES 16.0 | go1.26 | 1.26.9-160000.1.1 | SUSE-SU-2026:24239-1 |
| SLES 16.0 | go1.27 | 1.27.2-160000.1.1 | SUSE-SU-2026:24237-1 |
| SLE HPC 15 SP5 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLE HPC 15 SP5 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLE HPC 15 SP5 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
| SLE HPC 15 SP4 | go1.26 | 1.26.9-150000.1.33.1 | SUSE-SU-2026:4629-1 |
| SLE HPC 15 SP4 | go1.26-openssl | 1.26.10-150000.1.21.2 | SUSE-SU-2026:4867-1 |
| SLE HPC 15 SP4 | go1.27 | 1.27.2-150000.1.12.1 | SUSE-SU-2026:4625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.26 | 1.26.9-1.1 | openSUSE-SU-2026:12093-1 |
| openSUSE Tumbleweed | go1.27 | 1.27.2-1.1 | openSUSE-SU-2026:12101-1 |
| openSUSE Tumbleweed | rclone | 1.75.2-1.1 | openSUSE-SU-2026:12112-1 |
| openSUSE Leap 16.0 | go1.26 | 1.26.9-160000.1.1 | openSUSE-SU-2026:22095-1 |
| openSUSE Leap 16.0 | go1.27 | 1.27.2-160000.1.1 | openSUSE-SU-2026:22093-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.26.9-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | golang +6 | 1.26.9-1.amzn2023.0.1 | ALAS2023-2026-3225 |
| Amazon Linux 2 | golang +6 | 1.26.9-1.amzn2.0.1 | ALAS2-2026-4005 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | go-1.25 +8 | No fix yet | — |
| Wolfi rolling | renovate | 44.198.3-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | toolchain | < 1.26.9 · >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 | GO-2026-6601 |
Advisories 19
- WID-SEC-2026-3841 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:86196 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:86093 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:86203 Important: go-toolset:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3225 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2-2026-4005 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- SUSE-SU-2026:4867-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Oct 23, 2026
- SUSE-SU-2026:4866-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Oct 23, 2026
- SUSE-SU-2026:24237-1 Security update for go1.27 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24239-1 Security update for go1.26 SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22093-1 Security update for go1.27 SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:22095-1 Security update for go1.26 SUSE / openSUSE Security Updates · Oct 19, 2026
- RHSA-2026:79720 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:79715 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- SUSE-SU-2026:4625-1 Security update for go1.27 SUSE / openSUSE Security Updates · Oct 13, 2026
- SUSE-SU-2026:4629-1 Security update for go1.26 SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:12112-1 rclone-1.75.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:12101-1 go1.27-1.27.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 11, 2026
- openSUSE-SU-2026:12093-1 go1.26-1.26.9-1.1 on GA media SUSE / openSUSE Security Updates · Oct 10, 2026