CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
The Go compiler fails to check for integer overflows in loop induction variables, allowing invalid indexing that can lead to memory corruption and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27143?
CVE-2026-27143 is a critical vulnerability in Golang Go, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Which versions are affected by CVE-2026-27143?
2 open source packages ship an affected version, including golang and toolchain. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.9, 1.26.2 |
toolchain Go | All versions | 1.25.9, 1.26.2 |
Linux distribution packages (1)
kpt-cli openSUSE:Tumbleweed | All versions | 1.0.0~beta.64-1.1 |
Products include Golang Go.
How do I fix CVE-2026-27143?
Upgrade golang to a fixed version for your release line: 1.25.9 or 1.26.2.
Is CVE-2026-27143 being exploited?
There is no known exploitation of CVE-2026-27143 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
- CVE-2023-24538 Backticks not treated as string delimiters in html/template
Sources
Also known as AZL-98739, BELL-CVE-2026-27143, BIT-golang-2026-27143, CLEANSTART-2026-CJ92631, CLEANSTART-2026-JP90307, CLEANSTART-2026-QL41079 and 646 more.