https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 04:46:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-97040 <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> https://db.gcve.eu/vuln/fkie_cve-2026-97040 https://db.gcve.eu/vuln/ghsa-9767-p5x8-v2p2 <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> https://db.gcve.eu/vuln/ghsa-9767-p5x8-v2p2 https://db.gcve.eu/vuln/opensuse-su-2026:12529-1 <p>go1.26-1.26.11-1.1 on GA media</p> <p>go1.26-1.26.11-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:12529-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-97040 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 30 more</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 30 more</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-97040 https://db.gcve.eu/vuln/wid-sec-w-2026-4370 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4370