{"answers":{"affected":"2 open source packages ship an affected version, including golang and toolchain. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-27140 in the wild and no public exploit code.","fix":"Upgrade golang to a fixed version for your release line: 1.25.9 or 1.26.2.","what":"CVE-2026-27140 is a high-severity code injection vulnerability in Golang Go, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-27140 and fix it if it is affected.\n\nWhat it is: CVE-2026-27140 is a high-severity code injection vulnerability in Golang Go, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-27140 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- golang (Bitnami): affected all versions; fixed in 1.25.9, 1.26.2\n- toolchain (Go): affected all versions; fixed in 1.25.9, 1.26.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27140/ (Markdown: https://insights.sbomify.com/CVE-2026-27140/index.md)","id":"CVE-2026-27140","markdown":"https://insights.sbomify.com/CVE-2026-27140/index.md","name":"CVE-2026-27140","record":{"aliases":["AZL-98607","BELL-CVE-2026-27140","BIT-golang-2026-27140","CLEANSTART-2026-GQ35594","CLEANSTART-2026-KD34055","CLEANSTART-2026-OK73778","CLEANSTART-2026-PG05502","CLEANSTART-2026-ZY34480","DEBIAN-CVE-2026-27140","GHSA-5w89-2c2x-6x66","GO-2026-4871","MINI-2283-j33x-gcvw","MINI-245v-pq8g-p4c6","MINI-24f9-2ppc-c3wp","MINI-24mj-wwfj-7mg4","MINI-24q9-vf5w-4rpx","MINI-25mv-54xc-hq72","MINI-25vq-vc7h-q6hc","MINI-274x-f35f-73jx","MINI-275x-q75g-9v8f","MINI-27cq-93q2-cxhv","MINI-27hr-f637-x4mm","MINI-27mq-vpj7-wrh8","MINI-2958-wv2g-34jw","MINI-299c-gmmm-j99x","MINI-299p-v7r2-rvg4","MINI-29fm-2hwc-47v9","MINI-29v3-jvpw-fgqg","MINI-2cjf-8jjx-fgxq","MINI-2f79-ww96-xhpj","MINI-2fj3-ph6r-9q6x","MINI-2fpq-j33q-7g39","MINI-2h6v-87h8-8422","MINI-2hvr-8r2m-qvrf","MINI-2j93-p32p-7hm7","MINI-2jh6-4gfr-pqjf","MINI-2mp5-xrw2-7xhh","MINI-2mpx-fmvj-p9w8","MINI-2pgh-8ph3-6mj5","MINI-2pmg-gg6f-5p4g","MINI-2q8x-39x5-h8gm","MINI-2qvc-35fq-jq88","MINI-2v87-3hhg-3q5x","MINI-325c-gmjc-rr6g","MINI-32jg-x6cf-3pj7","MINI-3345-57jj-hfqc","MINI-334m-9jwf-3f8p","MINI-335r-cqff-fg4f","MINI-33h3-pqp8-9mx3","MINI-33jf-7rc6-795c","MINI-33jp-8xgv-gp7p","MINI-33vr-r7gw-42ww","MINI-344x-f9x3-qvc7","MINI-35rf-8922-584q","MINI-35vv-hhwg-j99c","MINI-36r2-326m-x8m3","MINI-36rv-6hg5-9m5r","MINI-38r9-x56w-q8mv","MINI-38vc-xp3q-qcfj","MINI-38w9-9x96-v977","MINI-39xv-c8hw-f5cj","MINI-3cfx-7448-jx9p","MINI-3cqj-fp6p-6c75","MINI-3f3f-mp66-hghr","MINI-3fv6-w2qx-qw9m","MINI-3h8g-mccm-3qv5","MINI-3hc5-q6pw-rq6q","MINI-3hcv-r35q-fhgf","MINI-3hj3-wqhj-3h4q","MINI-3j7w-mvw4-4qcr","MINI-3jrj-99ph-h778","MINI-3m2g-rh4c-wqf4","MINI-3m3p-wrj9-q67f","MINI-3m5q-p63c-pq5j","MINI-3mmv-5jmf-vrrq","MINI-3p9j-2vx3-7vv9","MINI-3pc6-w9qq-5cxm","MINI-3pjr-5rv6-cw3q","MINI-3ppq-7rh7-qghv","MINI-3pv5-29j9-39g7","MINI-3q4m-63rg-7r29","MINI-3r42-f5x7-58j8","MINI-3rgq-xx8f-xqxg","MINI-3v3r-6q4c-74q8","MINI-3v6h-2fvm-xxwr","MINI-3vf5-r2fp-282j","MINI-3x63-5q6c-x88p","MINI-3xhh-6hqh-6g38","MINI-424j-42jg-j4jx","MINI-424w-5f8w-v83w","MINI-4255-m6p4-fv3f","MINI-42qx-68qh-9w4c","MINI-444j-xcfh-c77c","MINI-44g4-c8q4-x8g9","MINI-44p2-85j2-m566","MINI-45hg-4pw8-v563","MINI-47mg-8h9f-j2xr","MINI-489j-ww3h-c292","MINI-49w3-3jgc-35hp","MINI-49xx-q9gq-jw9m","MINI-4c3j-frwh-9m44","MINI-4chr-jjg2-3534","MINI-4cjr-q975-wc29","MINI-4cq4-9j5v-pf3r","MINI-4cv5-82xh-34x2","MINI-4f82-9vcf-mp98","MINI-4fq9-cmr7-6fgq","MINI-4frg-vcm3-7qwp","MINI-4h3c-rxfq-x98p","MINI-4hch-2263-4fp5","MINI-4j2r-5mx8-jh46","MINI-4jgp-xh8j-f4h7","MINI-4jr5-rxf6-9m7j","MINI-4mjv-j43c-p8m3","MINI-4ph6-42rr-fc54","MINI-4pj9-hh2j-5fg4","MINI-4rm3-g989-6mmw","MINI-4v85-xfqw-m8ch","MINI-4vm6-qw8j-vq38","MINI-4w9h-2m59-p28f","MINI-4wcc-q636-7wj8","MINI-4xcf-q2wx-25g7","MINI-526j-xrwg-jxmj","MINI-534x-w594-xcf2","MINI-5356-w8cx-fjq3","MINI-53h8-6fhf-2wmj","MINI-552r-3pp2-r35m","MINI-56gj-8f89-rg9q","MINI-572c-cf9r-49qf","MINI-57h8-h54r-m9g8","MINI-57xm-fpc5-2968","MINI-58q5-j4w3-q428","MINI-59pj-9fq2-4fj9","MINI-59vf-7rc9-m2v5","MINI-5cp5-g64q-664c","MINI-5cxf-44f4-f4cr","MINI-5f3m-rcgp-qhqp","MINI-5ffw-9wpj-pp84","MINI-5gvr-p3qf-pw6x","MINI-5gx8-gqm6-hhjv","MINI-5h56-g74f-w85v","MINI-5hhc-4hgq-7m5c","MINI-5jfq-h8p6-v3v6","MINI-5jh6-3j4j-hm43","MINI-5jp8-66fj-xmhr","MINI-5q6w-v44w-7hfg","MINI-5qgp-qmgf-xw8g","MINI-5v27-99jc-2r7p","MINI-5v2x-85qj-rc4r","MINI-5v9c-mm7q-mpcf","MINI-5w57-vj2r-mh6h","MINI-5wmc-j7h4-94m7","MINI-5x98-6xcp-r765","MINI-5xh9-qrp6-c668","MINI-5xjx-pg42-x26x","MINI-5xv3-73qv-fvv3","MINI-5xvr-h3jw-m7wv","MINI-6253-hrr4-9m47","MINI-6495-rj6m-vw88","MINI-6534-2965-w22j","MINI-65w6-xgp6-p337","MINI-6638-xmjx-fchj","MINI-665q-r8cq-52cw","MINI-677v-pghw-vx2c","MINI-67fp-288r-8f6h","MINI-67p7-mcf6-q48g","MINI-69g7-fwvc-8x99","MINI-6c6g-9jc3-xx5x","MINI-6f2p-3695-96v2","MINI-6f5x-c87v-qjv5","MINI-6g5q-x7q2-6xw3","MINI-6g8c-565c-xwv6","MINI-6gcp-cf23-h4pc","MINI-6hhx-qv6h-xjg4","MINI-6hq2-rwhw-88x5","MINI-6m7f-pghc-6627","MINI-6mgc-qxw8-4h7w","MINI-6mrg-h773-jvw8","MINI-6mrq-mj7p-3xqw","MINI-6q93-vf6f-x77v","MINI-6qhq-chxq-rpf4","MINI-6vph-7jmm-9v6x","MINI-6w8m-vh39-3j66","MINI-6wj2-9h7g-h34q","MINI-6wwj-frwg-fxvh","MINI-725g-9834-729w","MINI-727j-3v88-rjj7","MINI-72c7-q9pr-x29p","MINI-72gx-ccv5-vrjg","MINI-72wj-84qr-55qh","MINI-7449-49g5-m25w","MINI-74fv-p4rp-5rf9","MINI-74gq-m44g-cfm7","MINI-75p4-27fq-x84r","MINI-7759-655v-gmjm","MINI-778x-4vmv-6r6h","MINI-77w4-xhc2-4fvv","MINI-78m5-r3rg-79vp","MINI-78pg-7hqm-96c8","MINI-78wg-8qjj-cqff","MINI-7fw5-m75p-2fwh","MINI-7gwq-4v8j-x89j","MINI-7j4w-gj5x-5pmm","MINI-7mgw-wf9x-j6h3","MINI-7p2j-8q89-6pf2","MINI-7p77-r6hh-cp6h","MINI-7p7f-hqr2-7997","MINI-7q36-8m5x-2865","MINI-7r3c-mwx4-59v6","MINI-7r7r-q2q7-4j6j","MINI-7rmw-gmrh-x8qr","MINI-7v7v-9qp3-gwvv","MINI-7vq2-jpg3-9rjp","MINI-7w8w-jgr9-ch77","MINI-7wqr-pfjc-78v4","MINI-7x23-c3xf-8992","MINI-7xjx-76vh-5pgc","MINI-7xp3-2646-854w","MINI-7xpg-c3r7-2q6q","MINI-82p5-x7xq-xhp8","MINI-83j3-62cx-5ffp","MINI-83j3-8pqp-g58r","MINI-856w-62gj-673w","MINI-85mg-667c-459w","MINI-85vq-f2jc-xrc3","MINI-89rw-74xq-8w4m","MINI-89xr-fxqp-q6wp","MINI-8c89-884f-f2rc","MINI-8f9j-jwqg-q5cc","MINI-8fg7-3wfp-2f48","MINI-8g86-qjw5-4qgw","MINI-8gm8-9873-9gcw","MINI-8h92-cj93-fhw4","MINI-8mmw-2wq3-q6fj","MINI-8q6w-xw8v-6jgr","MINI-8rcv-4f7h-jjh5","MINI-8rrq-8h32-p2h5","MINI-8rww-6jpw-64r6","MINI-8v2c-v4r8-ppwv","MINI-8v6x-3r6h-8c87","MINI-8v99-rc8v-296f","MINI-8vpj-vvp6-fqq7","MINI-8wrq-mrpr-9qgc","MINI-8xcq-xr76-x7pm","MINI-8xmg-9vhj-ccgm","MINI-92g8-qf34-mx7f","MINI-92px-rfmv-r5rj","MINI-94hc-p89m-cxp4","MINI-94r5-7qwg-xmm8","MINI-9567-wc79-m29f","MINI-9594-4g6f-589v","MINI-95rm-7vv6-c33r","MINI-95xm-whgq-3qm7","MINI-968x-g27j-m7x3","MINI-96cx-wqmj-ff4g","MINI-96r3-3rxg-5252","MINI-974h-84hw-qjf5","MINI-97gm-8gwr-3rmq","MINI-97w6-6h78-cmjx","MINI-989c-r7rv-q3jm","MINI-99r2-vphv-pppc","MINI-9c2h-pgpw-hgvh","MINI-9c9q-335x-ghhc","MINI-9cp9-f2c4-fgf5","MINI-9f5c-xrw2-gf6r","MINI-9fxg-6fx5-xpvp","MINI-9g43-3465-r2j3","MINI-9hvg-49v8-6mjc","MINI-9jm3-j4w8-qm5r","MINI-9jmr-33p6-rwr3","MINI-9jvq-82rm-p292","MINI-9m9x-95fr-6hjf","MINI-9mgv-gvgm-cj9j","MINI-9p4q-rm8f-h6cj","MINI-9ppc-5g6w-mf93","MINI-9pqv-q5j4-86vw","MINI-9q64-hvj2-jh3c","MINI-9q8p-qpq6-mxwx","MINI-9rf6-2j9f-9729","MINI-9v2w-5v79-p6hv","MINI-9w39-wp3m-qfxx","MINI-9w3v-57j6-jx24","MINI-9x9g-cqr4-6rjq","MINI-c362-mf4f-mhg7","MINI-c3wh-c9q6-3286","MINI-c3x2-qv47-8xh8","MINI-c43v-7jch-xx8g","MINI-c4vw-h8w7-4www","MINI-c542-f837-3476","MINI-c5f5-gmq3-m8w6","MINI-c66c-wxfj-gc96","MINI-c966-mm7h-4227","MINI-c99p-p3v3-82jr","MINI-ccq3-6gq4-q4h5","MINI-cf73-wf99-fpmw","MINI-cg8v-854p-jgg7","MINI-cghg-v6hq-3wfx","MINI-cjm3-j22m-gr49","MINI-cm45-mx77-fh6r","MINI-cmc6-23r4-4pv9","MINI-cmr8-9xr7-2xg5","MINI-cp5f-prxj-6j88","MINI-cppf-92r2-vpcj","MINI-cr58-cgp6-hp97","MINI-crc9-g57f-w7mf","MINI-crcp-p425-73rh","MINI-crrx-9v9v-mpmw","MINI-cw9v-v88m-xq9m","MINI-cwm9-4wx4-6xfq","MINI-cwv2-vv73-8rcp","MINI-cxr7-3xhc-vvcr","MINI-f324-qxrq-jv5r","MINI-f3pc-w58v-9m8q","MINI-f4fh-jqxj-55rr","MINI-f54v-p3cc-3qjm","MINI-f646-93rg-r8pm","MINI-f653-8627-gm4p","MINI-f8g7-hjv2-m33j","MINI-f8h3-mf47-3wq2","MINI-f8qg-6782-7vcc","MINI-f999-2vw4-h546","MINI-f99q-2xr4-c2gm","MINI-f9f2-r9wm-m84f","MINI-fc83-93v8-6j4x","MINI-fc99-p6gx-7qfx","MINI-fchv-37g9-8pwv","MINI-fcmv-88cv-9g62","MINI-ff3g-856x-hhmr","MINI-fg7j-9pc7-mvc7","MINI-fg95-2vm3-f7q2","MINI-fh5w-9wch-j462","MINI-fh68-p7xj-xrqv","MINI-fj23-gf5c-8mfj","MINI-fjjh-8f7j-jh37","MINI-fm56-977w-jm23","MINI-fmjx-9vc6-6r8r","MINI-fmq7-r6qw-444v","MINI-fmxm-7mhg-vvqq","MINI-fphr-gp28-h2g4","MINI-fpj5-w8q6-h4xg","MINI-fqw2-f7m2-mwhr","MINI-fr6f-84p7-pv9m","MINI-fv37-6954-vx3r","MINI-fv68-g55h-jhfv","MINI-fv77-58ph-823w","MINI-fx4r-gp4r-p3j9","MINI-fxvm-h6rf-j2h6","MINI-g2j6-3x5h-q53h","MINI-g337-8c7x-3qqf","MINI-g45p-hxxg-x6gp","MINI-g47v-pxxm-fcv4","MINI-g7p6-qm8x-xj97","MINI-g93w-788c-5f92","MINI-gcv9-395x-q6q2","MINI-gfm8-45gg-vvpw","MINI-gfq7-9cr6-gfjm","MINI-gg9j-8jjc-mc55","MINI-ggj5-f9j4-hr8c","MINI-ggjc-g9qh-jrf7","MINI-ggx6-r2m4-q7w9","MINI-gj9w-4gfw-x9gq","MINI-gjww-wcm4-74pc","MINI-gm6q-9c2m-8gxg","MINI-gm9r-98w4-cww7","MINI-gmcp-w4hv-93gj","MINI-gqf2-ch59-pf7j","MINI-gqhh-xf3m-2xv6","MINI-gqvj-pf5x-7m8c","MINI-gr4f-cwwc-33w9","MINI-gr5q-f688-rq26","MINI-gv56-qch8-mfcw","MINI-gxc3-mrrx-2vgf","MINI-gxrw-2cf4-9h84","MINI-h2c2-wxvr-pc28","MINI-h2v4-3gpg-mxx5","MINI-h4xj-jfph-fhm9","MINI-h5cw-xh8j-q6pf","MINI-h622-7hmx-pcf5","MINI-h84h-48q3-72x5","MINI-h86c-rh8p-9gv3","MINI-h86q-vm4j-37g7","MINI-h8mx-hhjj-9mgj","MINI-h8r5-3w82-f52v","MINI-h964-vw92-77pv","MINI-hc5j-7fq5-jpmr","MINI-hchq-q88v-439q","MINI-hcmv-fw52-j276","MINI-hcw7-23c8-559g","MINI-hfmw-p8hj-f6fp","MINI-hg5w-rpcx-gx22","MINI-hg6g-xgqf-jhp5","MINI-hgw2-mf66-qcm6","MINI-hhp3-jjg6-2mx2","MINI-hjfx-9jjq-f5pv","MINI-hjjr-5j87-gmvr","MINI-hjr2-9rf8-8mww","MINI-hpvj-7qwf-4f2c","MINI-hq88-wm8h-jvg7","MINI-hq9r-c3mc-gf38","MINI-hqf9-27w5-6gm7","MINI-hqpr-m7px-3937","MINI-hqww-fgh8-jx2q","MINI-hr3j-37rr-9rpr","MINI-hr6r-7rwr-w2qw","MINI-hvc6-h352-rc57","MINI-hvmc-vwmh-vxj8","MINI-hw43-fj54-69w3","MINI-hw48-mg4p-9q5x","MINI-hx2r-7ph8-px37","MINI-j2gx-wpqh-g692","MINI-j393-2fvx-cjvx","MINI-j4h6-56px-5v6x","MINI-j4w5-6757-5j8r","MINI-j553-2qfr-3cw5","MINI-j5jg-p8cx-8g4g","MINI-j65f-pmc5-5m2w","MINI-j69c-3r3h-573v","MINI-j6hx-c39g-fh5w","MINI-j6vf-m5hp-xwc8","MINI-j6xq-x2qh-wj9x","MINI-j7pw-fmj2-cc3j","MINI-j952-p8qr-6g42","MINI-j9w8-xf24-xp3r","MINI-jf34-932w-jv95","MINI-jg25-28hx-whxc","MINI-jgpx-9vwq-95m6","MINI-jjqh-vh3j-j5m8","MINI-jjx3-xj68-m69r","MINI-jpm4-pf3j-3vf8","MINI-jq2v-23mw-qcq2","MINI-jqm5-8m8g-5r93","MINI-jrwq-mpg7-q9j4","MINI-jvww-9m59-hm33","MINI-jw2g-rxxp-jmj7","MINI-jw3h-4ffh-qggv","MINI-jxq8-pw2v-gjpf","MINI-jxrf-4xf8-6r67","MINI-m2pw-frgh-wr7q","MINI-m3jr-g73v-95rg","MINI-m49f-c75x-gfv3","MINI-m562-r557-4j9r","MINI-m56m-w33g-2w54","MINI-m63m-fhpj-x25x","MINI-m64g-qqfj-62cf","MINI-m6f4-r523-mr62","MINI-m6gq-4rch-r2q2","MINI-m6pv-2h8h-p2wv","MINI-m6qx-jccv-88gw","MINI-m73w-vv7h-vrrf","MINI-m78h-vwxv-953q","MINI-m7w5-gf7p-98jh","MINI-m978-pjxq-cjc5","MINI-mcvh-9jcc-97w8","MINI-mcwr-4mvh-wgr5","MINI-mcxc-c56j-j4wp","MINI-mf42-rvvv-gr94","MINI-mfjc-cp3g-2hqq","MINI-mfpp-f9jm-gpmr","MINI-mg7v-cgx2-fx4h","MINI-mgc9-vf2j-q3hv","MINI-mgf4-fjr5-qqfh","MINI-mh4f-7vq9-vp92","MINI-mhpq-9p9m-mqx8","MINI-mhw6-q4pg-g962","MINI-mjg9-x5c5-4vg4","MINI-mjrv-28x9-g98w","MINI-mjvp-63mx-jvwq","MINI-mmfv-8v3v-9882","MINI-mmw3-qm9p-9pq3","MINI-mp9h-vwpf-2v6x","MINI-mvxf-f53r-r73j","MINI-mw2p-4qr8-qgrx","MINI-mwhg-x8g8-g3p8","MINI-mwv3-3vwq-8ffj","MINI-p239-v9gq-m2ff","MINI-p25j-cqc2-c8v4","MINI-p28h-crm8-mr2c","MINI-p2xf-qfv5-jwvj","MINI-p2xp-cwj9-xrm8","MINI-p3x4-jm6m-gq82","MINI-p46x-8xwr-4vm3","MINI-p4fr-54cr-7h2v","MINI-p4w7-84hv-xq36","MINI-p5x7-4883-rpxh","MINI-p876-c6qq-2fmj","MINI-pc4f-r3c9-gw8m","MINI-pcf6-j7hj-g4g7","MINI-pf39-9c2f-4w3w","MINI-pf4j-xw3g-qpf2","MINI-pgmp-gw99-3fqq","MINI-ph2w-v63w-7wpp","MINI-ph84-7xfc-58qp","MINI-pj84-wh65-fg97","MINI-pjfc-7x4q-2328","MINI-pjfr-8xjr-v8p6","MINI-pjj3-q54f-qrqx","MINI-pm84-7c7j-pj4w","MINI-pmg4-3prr-982h","MINI-ppjc-97ph-c26v","MINI-pprw-prvh-q3v9","MINI-pq5q-24j8-hp64","MINI-pr82-vjqw-qx9q","MINI-pv4j-frh8-mmf7","MINI-pv6q-m9w9-r748","MINI-pv6w-4235-8g5q","MINI-pvj8-gpc3-jm8j","MINI-pvqj-c94h-6q4h","MINI-px45-3c34-wcxg","MINI-q29j-2rqv-82mm","MINI-q2c5-fq74-w9rw","MINI-q3j8-w6r6-6gfp","MINI-q3mj-2cjf-hwhx","MINI-q59m-c6qg-r6vv","MINI-q5j4-f98v-8mhc","MINI-q64g-42v8-p3rq","MINI-q6wr-cwg3-g752","MINI-q6xp-hrhh-8633","MINI-q758-gpw9-5mrw","MINI-q773-9434-vp94","MINI-q78q-cq8x-8649","MINI-q878-294c-r94x","MINI-q889-q9h6-rwj5","MINI-q8xj-ggr9-gw5w","MINI-q98x-j266-6jhr","MINI-q9cr-6mj5-5j87","MINI-qc78-57vw-h95h","MINI-qgg8-f5v6-j65c","MINI-qgjp-3rvv-8pcw","MINI-qh87-22r8-4jfc","MINI-qj8x-cmg8-3w5m","MINI-qjxx-75jc-wp5h","MINI-qprc-928g-4wph","MINI-qq3f-wpc2-hvw2","MINI-qqw9-c28x-66wf","MINI-qr7h-jr5q-2vf8","MINI-qrj5-whhc-ch4c","MINI-qv73-79xh-9h3g","MINI-qv9g-g222-4jh4","MINI-qvrq-4gq5-h46g","MINI-qxrw-5vmr-wcmx","MINI-qxvp-4c5v-9hhp","MINI-r284-ff48-6r75","MINI-r299-944q-gv4j","MINI-r2g8-j395-53xp","MINI-r3q4-jfp6-rp4h","MINI-r3qh-h4mw-qj8j","MINI-r5h8-4q35-2p23","MINI-r5hc-9j73-28fq","MINI-r5rv-vj4g-2hw3","MINI-r7fv-6p5p-cm83","MINI-r7vx-3xj5-h8vh","MINI-r873-xm95-v2x3","MINI-r959-vxqr-mhgw","MINI-rc36-9rpg-6gq3","MINI-rf8h-rwm6-phxv","MINI-rfh8-rc36-8phq","MINI-rggp-x7mq-j6j3","MINI-rhmj-39v3-4cxr","MINI-rhqh-72qg-vwxr","MINI-rm8f-m54r-hrg3","MINI-rmm3-j3r3-mv87","MINI-rp3g-9qj8-pmrf","MINI-rq92-p7qf-jh99","MINI-rqh9-9jcw-vxmh","MINI-rrm4-v454-c67f","MINI-rvv2-mqmx-5wxg","MINI-rvx2-6pv8-34jv","MINI-rw4w-4gwm-8fp7","MINI-rx89-v4q9-hj5j","MINI-rxf6-xcr8-xv3h","MINI-rxq3-2r52-mc98","MINI-rxrq-hh83-4323","MINI-v2f4-5j2p-wm49","MINI-v345-qw84-x8hj","MINI-v3wc-5p84-3546","MINI-v436-phff-f47x","MINI-v438-44h4-v68x","MINI-v4xv-xrrp-7h5j","MINI-v6ch-r5g2-gmh7","MINI-v7r7-4j7x-7rmh","MINI-v7wv-vf8m-rwwm","MINI-v9g6-f74h-wq96","MINI-v9hg-5gp8-q9p4","MINI-v9wf-5pm9-rj7j","MINI-vc3q-fqj4-2cv2","MINI-vc7q-2x7r-qhwg","MINI-vgmg-7chx-h355","MINI-vgqr-cqc5-57hx","MINI-vh58-m2qr-h8xj","MINI-vj5h-gfr2-r58m","MINI-vjc8-9mq6-8xq5","MINI-vmp4-c9qx-gfp2","MINI-vpf3-f6qc-w24x","MINI-vq5p-3cvp-mj82","MINI-vqm9-pfc4-9v42","MINI-vqw6-p2x4-4p7c","MINI-vr96-9qcq-xghg","MINI-vw6q-96j5-8756","MINI-vx5v-w576-fgj6","MINI-w2rr-m8wp-7798","MINI-w3pf-xxf7-ggpq","MINI-w3qm-34jf-v89h","MINI-w3xf-q62h-65rr","MINI-w45g-9hpq-q7vm","MINI-w4hh-89v8-62j5","MINI-w4j5-w685-6f5w","MINI-w4v2-w3ff-cwvj","MINI-w69w-vm28-r9vj","MINI-w7wj-j5qw-4r8q","MINI-w832-r9hq-x633","MINI-w9gx-53hg-pgp3","MINI-wc4f-rcr9-66v6","MINI-wc4j-rrvf-h7xv","MINI-wfjv-4hf3-85g9","MINI-wgmx-v5fx-p82q","MINI-wgw6-cc5c-vr7x","MINI-wh32-f262-49xf","MINI-whch-3x5m-4mpx","MINI-whmg-2483-2m6g","MINI-wjvg-rc85-4555","MINI-wrqg-v755-rvq7","MINI-wvw7-vr9p-qpc9","MINI-ww2c-cr29-mf86","MINI-wwpw-mw57-59r9","MINI-x2q6-v75r-4p8c","MINI-x32r-659j-7v5x","MINI-x49m-x826-qg57","MINI-x4hr-h5wm-r63p","MINI-x5mc-frcm-r6qm","MINI-x5xv-wmf2-rgxv","MINI-x648-f39q-jq5h","MINI-x75p-c8hh-g554","MINI-x77w-cwgf-5gx6","MINI-x7v7-593f-j4ph","MINI-x877-8xm6-8qmj","MINI-x87j-c39m-4pjx","MINI-xgr2-c6j5-r86f","MINI-xh78-g62m-2657","MINI-xhg5-3cqf-7q3f","MINI-xp64-gp86-fmhv","MINI-xpm2-47v8-c58x","MINI-xq75-m4gc-3gv7","MINI-xqgm-v59x-7c9h","MINI-xqhj-gwjq-c6w2","MINI-xrrg-49px-6rwx","MINI-xwm7-qp7j-qwq5","MINI-xxp6-7hjr-qq3f","RHSA-2026:16494","RHSA-2026:16497","RHSA-2026:16498","RHSA-2026:16694","RHSA-2026:16697","RHSA-2026:16698","UBUNTU-CVE-2026-27140"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Go toolchain","requires_auth":"none","summary":"Attackers can execute arbitrary code during build time by crafting SWIG filenames that bypass trust layers in the Go toolchain.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Go","cpe":[{"product":"go","vendor":"golang"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-641","name":"Improper Restriction of Names for Files and Other Resources"}],"description":"SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.","ecosystems":["Bitnami","Go","Red Hat:rhel_aus:8.4::appstream","Red Hat:rhel_aus:8.6::appstream","Red Hat:rhel_e4s:8.6::appstream","Red Hat:rhel_e4s:8.8::appstream","Red Hat:rhel_e4s:9.0::appstream","Red Hat:rhel_e4s:9.2::appstream","Red Hat:rhel_eus:9.4::appstream","Red Hat:rhel_eus_long_life:8.4::appstream","Red Hat:rhel_tus:8.6::appstream","Red Hat:rhel_tus:8.8::appstream"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Code execution vulnerability in SWIG code generation in cmd/go","id":"CVE-2026-27140","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"golang:go","products":["golang:go"],"type":"code_injection","year":"2026"},"n_packages":100,"n_references":4,"next":{"headline":"Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net","id":"CVE-2026-27141"},"packages":[{"ecosystem":"Bitnami","fixed":["1.25.9","1.26.2"],"introduced":["0","1.26.0-0"],"last_affected":[],"package":"golang","purl":"pkg:bitnami/golang","source":"BIT-golang-2026-27140"},{"ecosystem":"Go","fixed":["1.25.9","1.26.2"],"introduced":["0","1.26.0-0"],"last_affected":[],"package":"toolchain","purl":"pkg:golang/toolchain","source":"GO-2026-4871"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"],"introduced":["0"],"last_affected":[],"package":"delve","purl":"pkg:rpm/redhat/delve","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"],"introduced":["0"],"last_affected":[],"package":"delve-debuginfo","purl":"pkg:rpm/redhat/delve-debuginfo","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.5.0-2.module+el8.4.0+8864+58b0fcdb"],"introduced":["0"],"last_affected":[],"package":"delve-debugsource","purl":"pkg:rpm/redhat/delve-debugsource","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-3.module+el8.4.0+22765+91da4d3f"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/redhat/go-toolset","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/redhat/golang","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-bin","purl":"pkg:rpm/redhat/golang-bin","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-docs","purl":"pkg:rpm/redhat/golang-docs","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-misc","purl":"pkg:rpm/redhat/golang-misc","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-race","purl":"pkg:rpm/redhat/golang-race","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-src","purl":"pkg:rpm/redhat/golang-src","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","fixed":["0:1.15.14-22.module+el8.4.0+24267+d2faeddf"],"introduced":["0"],"last_affected":[],"package":"golang-tests","purl":"pkg:rpm/redhat/golang-tests","source":"RHSA-2026:16698"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve","purl":"pkg:rpm/redhat/delve","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve-debuginfo","purl":"pkg:rpm/redhat/delve-debuginfo","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve-debugsource","purl":"pkg:rpm/redhat/delve-debugsource","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-2.module+el8.6.0+22782+bd95fb4c"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/redhat/go-toolset","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/redhat/golang","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-bin","purl":"pkg:rpm/redhat/golang-bin","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-docs","purl":"pkg:rpm/redhat/golang-docs","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-misc","purl":"pkg:rpm/redhat/golang-misc","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-race","purl":"pkg:rpm/redhat/golang-race","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-src","purl":"pkg:rpm/redhat/golang-src","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-tests","purl":"pkg:rpm/redhat/golang-tests","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve","purl":"pkg:rpm/redhat/delve","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve-debuginfo","purl":"pkg:rpm/redhat/delve-debuginfo","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.7.2-1.module+el8.6.0+12972+ebab5911"],"introduced":["0"],"last_affected":[],"package":"delve-debugsource","purl":"pkg:rpm/redhat/delve-debugsource","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-2.module+el8.6.0+22782+bd95fb4c"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/redhat/go-toolset","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/redhat/golang","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-bin","purl":"pkg:rpm/redhat/golang-bin","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-docs","purl":"pkg:rpm/redhat/golang-docs","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-misc","purl":"pkg:rpm/redhat/golang-misc","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-race","purl":"pkg:rpm/redhat/golang-race","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-src","purl":"pkg:rpm/redhat/golang-src","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","fixed":["0:1.17.13-16.module+el8.6.0+24266+ace38400"],"introduced":["0"],"last_affected":[],"package":"golang-tests","purl":"pkg:rpm/redhat/golang-tests","source":"RHSA-2026:16697"},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","fixed":["0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"],"introduced":["0"],"last_affected":[],"package":"delve","purl":"pkg:rpm/redhat/delve","source":"RHSA-2026:16694"},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","fixed":["0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"],"introduced":["0"],"last_affected":[],"package":"delve-debuginfo","purl":"pkg:rpm/redhat/delve-debuginfo","source":"RHSA-2026:16694"},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","fixed":["0:1.9.1-1.module+el8.8.0+16778+5fbb74f5"],"introduced":["0"],"last_affected":[],"package":"delve-debugsource","purl":"pkg:rpm/redhat/delve-debugsource","source":"RHSA-2026:16694"},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","fixed":["0:1.19.13-4.module+el8.8.0+23976+18ba1869"],"introduced":["0"],"last_affected":[],"package":"go-toolset","purl":"pkg:rpm/redhat/go-toolset","source":"RHSA-2026:16694"},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","fixed":["0:1.19.13-24.module+el8.8.0+24268+9f9e0e19"],"introduced":["0"],"last_affected":[],"package":"golang","purl":"pkg:rpm/redhat/golang","source":"RHSA-2026:16694"}],"prev":{"headline":"FileInfo can escape from a Root in os","id":"CVE-2026-27139"},"products":["cmd/go"],"published":"2026-04-08","related":[{"cvss_score":8.1,"headline":"Microsoft Windows CryptoAPI Spoofing","id":"CVE-2020-0601","kev_date_added":"2021-11-03","published":"2020-01-14"},{"cvss_score":9.8,"headline":"Missing bound checks can lead to memory corruption in safe Go in cmd/compile","id":"CVE-2026-27143","kev_date_added":null,"published":"2026-04-08"},{"cvss_score":9.8,"headline":"Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip","id":"CVE-2024-24790","kev_date_added":null,"published":"2024-06-05"},{"cvss_score":9.8,"headline":"Arbitrary code execution via go.mod toolchain directive in cmd/go","id":"CVE-2023-39320","kev_date_added":null,"published":"2023-09-08"},{"cvss_score":9.8,"headline":"Improper handling of JavaScript whitespace in html/template","id":"CVE-2023-24540","kev_date_added":null,"published":"2023-05-11"},{"cvss_score":9.8,"headline":"Backticks not treated as string delimiters in html/template","id":"CVE-2023-24538","kev_date_added":null,"published":"2023-04-06"},{"cvss_score":9.8,"headline":"Other in go/golang","id":"CVE-2012-2666","kev_date_added":null,"published":"2021-07-09"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-10","vendors":["Go toolchain"]},"summary":"Attackers can execute arbitrary code during build time by crafting SWIG filenames that bypass trust layers in the Go toolchain.","url":"https://insights.sbomify.com/CVE-2026-27140/"}