GO-2026-4868

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-4868
Import Source
https://vuln.go.dev/ID/GO-2026-4868.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-4868
Aliases
Related
Published
2026-04-07T22:53:49Z
Modified
2026-04-18T09:26:01.523258952Z
Summary
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Details

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Database specific 
{
    "url": "https://pkg.go.dev/vuln/GO-2026-4868",
    "review_status": "REVIEWED"
}
References
Credits
    • Jakub Ciolek - https://ciolek.dev/

Affected packages

Go / toolchain

Package

Name
toolchain
View open source insights on deps.dev
Purl
pkg:golang/toolchain

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.25.9
Introduced
1.26.0-0
Fixed
1.26.2

Ecosystem specific 

{
    "imports": [
        {
            "path": "cmd/compile"
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-4868.json"