CVE-2026-27143
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Apr 8, 2026
CISA due date
—
The record
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | go1.25 | 0 | 1.25.9-160000.1.1 |
| openSUSE:Leap 16.0 | go1.26 | 0 | 1.26.2-160000.1.1 |
| openSUSE:Tumbleweed | go1.25 | 0 | 1.25.9-1.1 |
| openSUSE:Tumbleweed | go1.26 | 0 | 1.26.2-1.1 |
| openSUSE:Tumbleweed | kpt-cli | 0 | 1.0.0~beta.64-1.1 |
Related vulnerabilities
- CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
- CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
- CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects go1.25
- CVE-2026-27144 The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op… Also affects go1.25
- CVE-2026-32282 On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod… Also affects go1.25
- CVE-2026-32280 During chain building, the amount of work that is done is not correctly limited when a… Also affects go1.25
- CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when… Also affects go1.25
- CVE-2026-32283 If one side of the TLS connection sends multiple key update messages post-handshake in a… Also affects go1.25