https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 04:58:09 +0000 https://db.gcve.eu/vuln/cve-2026-97040 <p><strong>Affected:</strong> Go toolchain cmd/go, Go toolchain cmd/link</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> <p><strong>Affected:</strong> Go toolchain cmd/go, Go toolchain cmd/link</p> <p>Building a package containing a crafted &#34;.syso&#34; file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading &#34;.syso&#34; entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A &#34;.syso&#34; file beginning with a &#34;go object&#34; header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as &#34;cgo_ldflag&#34; or &#34;cgo_dynamic_linker&#34;) embedded in the &#34;.syso&#34; file to be passed to the external linker without validation. Additionally, &#34;.syso&#34; filenames longer than 16 bytes lost their &#34;.syso&#34; extension when truncated in archive headers, and unrecognized &#34;.syso&#34; formats forced external linking in pure-Go builds. The linker now rejects &#34;.syso&#34; files that are not recognized host object formats, and &#34;cmd/go&#34; and &#34;cmd/pack&#34; preserve the &#34;.syso&#34; suffix when truncating long archive member names.</p> https://db.gcve.eu/vuln/cve-2026-97040