EUVD-2026-123103

Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation...

CVE-2026-97041

The Go toolchain is vulnerable to host linker flag injection on ELF platforms when building packages containing malicious //go:cgo_* compiler directives. The root cause is that the compiler and linker failed to reject commas or leading @ symbols in directives such as //go:cgo_import_dynamic, //go...

CVE-2026-97040

The Go toolchain (specifically cmd/go and cmd/link ) is vulnerable to Cgo directive injection when building a package containing a crafted .syso file. The root cause is that the linker only validated recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object p...

CVE-2026-97042

The Go toolchain is vulnerable to linker flag injection when building malicious packages that use //go:cgo_import_dynamic or link against crafted PE objects on Windows . The underlying cause is insufficient validation: the compiler only checked the first character of library names in //go:cgo_imp...

PT-2026-144965

Building a malicious package that uses "//go:cgo import dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo import dynamic" directives and skipped...

CVE-2026-97042: Go toolchain: Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could…

Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation...

Security update for go1.16 (moderate)

openSUSE Security Update: Security update for go1.16 Announcement ID: openSUSE-SU-2021:1199-1 Rating: moderate References: 1182345 1189162 Cross-References: CVE-2021-36221 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability and has one errata is now available.Description...

Security update for go1.16 (moderate)

openSUSE Security Update: Security update for go1.16 Announcement ID: openSUSE-SU-2021:2788-1 Rating: moderate References: 1182345 1189162 Cross-References: CVE-2021-36221 Affected Products: openSUSE Leap 15.3 An update that solves one vulnerability and has one errata is now available.Description...

SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2020:3368-1)

This update for go1.15 fixes the following issues : go1.15.5 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into c...

openSUSE Security Update : go1.15 (openSUSE-2020-2139)

This update for go1.15 fixes the following issues : - go1.15.5 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into...