7.8Alta

CVE-2026-94447Checksum database bypass for golang.org/toolchain in cmd/go

Go toolchain cmd/go Publicada: 2026-10-09 01:53 (hace 1 mes)

Descripción

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

Debilidad (CWE): CWE-354

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Go toolchain	cmd/go	< 1.26.9, 1.27.0-0 – < 1.27.2

Referencias y parches

Puntuación CVSS

7.8Alta

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Local
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Requerida
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Todas las puntuaciones (2)

CISA-ADP	CVSS 3.1	7.8Alta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Alta

EPSS (probabilidad de explotación en 30 días)

0.10%

superior al 1 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2026-09-21
Publicada2026-10-09 01:53
Llegó a IP-DB2026-10-24 23:42
Última actualización2026-10-15 19:18

Asignada por (CNA): Go
Estado en NVD: Awaiting Analysis

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Go

Sin puntuación

CVE-2026-97033 hace 13 horas

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Sin puntuación

CVE-2026-97034 hace 13 horas

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Sin puntuación

CVE-2026-97054 hace 13 horas

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Sin puntuación

CVE-2026-97035 hace 13 horas

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Sin puntuación

CVE-2026-97036 hace 13 horas

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Sin puntuación

CVE-2026-97037 hace 13 horas

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…