CVE-2026-27140
High · 8.8CVSS
8.8
EPSS
0.7%
Published
Apr 8, 2026
CISA due date
—
The record
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | go1.25 | 0 | 1.25.9-160000.1.1 |
| openSUSE:Leap 16.0 | go1.26 | 0 | 1.26.2-160000.1.1 |
| openSUSE:Tumbleweed | coredns | 0 | 1.14.3-1.1 |
| openSUSE:Tumbleweed | go1.25 | 0 | 1.25.9-1.1 |
| openSUSE:Tumbleweed | go1.26 | 0 | 1.26.2-1.1 |
Related vulnerabilities
- CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
- CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
- CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects go1.25
- CVE-2026-27144 The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op… Also affects go1.25
- CVE-2026-27143 Arithmetic over induction variables in loops were not correctly checked for underflow or… Also affects go1.25
- CVE-2026-32282 On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod… Also affects go1.25
- CVE-2026-32280 During chain building, the amount of work that is done is not correctly limited when a… Also affects go1.25
- CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when… Also affects go1.25