GO-2026-6851

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6851

Import Source

https://vuln.go.dev/ID/GO-2026-6851.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6851

Aliases

CVE-2026-97040

Published

2026-11-11T02:51:11Z

Modified

2026-11-11T03:15:14Z

Summary

Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link

Details

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking.

When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds.

The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6851"
}

References

Credits

- RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

Affected packages

Go / toolchain

Package

Name: toolchain; View open source insights on deps.dev
Purl: pkg:golang/toolchain

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.11

Introduced

1.27.0-0

Fixed

1.27.4

Ecosystem specific

{
    "imports": [
        {
            "path": "cmd/go"
        },
        {
            "path": "cmd/link"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6851.json"