- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 3
- Registry
- pkg.go.dev
Advisories 3
- CVE-2026-97040Unrated
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
Affected: fixed in 1.26.11; from 1.27.0-0, fixed in 1.27.4.
- CVE-2026-97041Unrated
Host linker flag injection via //go:cgo_ directives in cmd/compile and cmd/link
Affected: fixed in 1.26.11; from 1.27.0-0, fixed in 1.27.4.
- CVE-2026-97042Unrated
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Affected: fixed in 1.26.11; from 1.27.0-0, fixed in 1.27.4.