Skip to content
cve.newCreate a CVE report

toolchain

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6848

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6849

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6850

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6851

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6852

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6853

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6854

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6855

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6856

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6857

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.11Semantic versions1.26.11
From 1.27.0-0 before 1.27.4Semantic versions1.27.4

Version evidence: OSV · GO-2026-6858

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.11"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6602Package fixes recorded

Checksum database bypass for golang.org/toolchain in cmd/go

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum.

Recorded fixes — toolchain: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / toolchain
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6602

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-6601Package fixes recorded

Checksum bypass for golang.org/fips140 in cmd/go

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place.

Recorded fixes — toolchain: 1.26.9 or 1.27.2. Check your release branch.

Exploitation not established

Go / toolchain
toolchain Go
Affected range Recorded fix
Earlier releases before 1.26.9Semantic versions1.26.9
From 1.27.0-0 before 1.27.2Semantic versions1.27.2

Version evidence: OSV · GO-2026-6601

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.26.9"
        },
        {
          "introduced": "1.27.0-0"
        },
        {
          "fixed": "1.27.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4984

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4979Package fixes recorded

Invoking "go tool pack" does not sanitize output paths in cmd/go

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

Recorded fixes — toolchain: 1.25.10 or 1.26.3. Check your release branch.

Exploitation not established

Go / toolchain
toolchain Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4979

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
toolchain Go
Affected range Recorded fix
Earlier releases before 1.25.10Semantic versions1.25.10
From 1.26.0-0 before 1.26.3Semantic versions1.26.3

Version evidence: OSV · GO-2026-4978

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.10"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4868Package fixes recorded

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Recorded fixes — toolchain: 1.25.9 or 1.26.2. Check your release branch.

Exploitation not established

Go / toolchain
toolchain Go
Affected range Recorded fix
Earlier releases before 1.25.9Semantic versions1.25.9
From 1.26.0-0 before 1.26.2Semantic versions1.26.2

Version evidence: OSV · GO-2026-4868

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.9"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
unknown
GO-2026-4867Package fixes recorded

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Recorded fixes — toolchain: 1.25.9 or 1.26.2. Check your release branch.

Exploitation not established

Go / toolchain
toolchain Go
Affected range Recorded fix
Earlier releases before 1.25.9Semantic versions1.25.9
From 1.26.0-0 before 1.26.2Semantic versions1.26.2

Version evidence: OSV · GO-2026-4867

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.25.9"
        },
        {
          "introduced": "1.26.0-0"
        },
        {
          "fixed": "1.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}