5.3Media

CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

Go toolchain cmd/go Publicada: 2026-05-07 22:41 (hace 6 meses)

Descripción

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Debilidad (CWE): CWE-377 CWE-59

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Go toolchain	cmd/go	< 1.25.10, 1.26.0-0 – < 1.26.3
golang	go	< 1.25.10

Referencias y parches

https://go.dev/issue/78584 Issue Tracking
https://go.dev/cl/763882 Patch
https://groups.google.com/g/golang-announce/c/qcCIEXso47M Issue TrackingMailing List
https://pkg.go.dev/vuln/GO-2026-4978 Vendor Advisory

Coincidencias CPE (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.25.10
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.26.0 < 1.26.3

Puntuación CVSS

5.3Media

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Local
Complejidad: Alta
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Bajo
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Todas las puntuaciones (3)

CISA-ADP	CVSS 3.1	5.3Media
nvd	CVSS 3.1	5.3Media
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.3Media

EPSS (probabilidad de explotación en 30 días)

0.18%

superior al 8 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-04-07
Publicada2026-05-07 22:41
Llegó a IP-DB2026-10-24 23:50
Última actualización2026-06-17 13:42

Asignada por (CNA): Go
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Go

Sin puntuación

CVE-2026-97033 hace 13 horas

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Sin puntuación

CVE-2026-97034 hace 13 horas

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Sin puntuación

CVE-2026-97054 hace 13 horas

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Sin puntuación

CVE-2026-97035 hace 13 horas

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Sin puntuación

CVE-2026-97036 hace 13 horas

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Sin puntuación

CVE-2026-97037 hace 13 horas

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…