CVE-2026-27144
High · 7.1CVSS
7.1
EPSS
0.3%
Published
Apr 8, 2026
CISA due date
—
The record
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | go1.25 | 0 | 1.25.9-160000.1.1 |
| openSUSE:Leap 16.0 | go1.26 | 0 | 1.26.2-160000.1.1 |
| openSUSE:Tumbleweed | coredns | 0 | 1.14.3-1.1 |
| openSUSE:Tumbleweed | go1.25 | 0 | 1.25.9-1.1 |
| openSUSE:Tumbleweed | go1.26 | 0 | 1.26.2-1.1 |
Related vulnerabilities
- CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
- CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
- CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects go1.25
- CVE-2026-27143 Arithmetic over induction variables in loops were not correctly checked for underflow or… Also affects go1.25
- CVE-2026-32282 On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod… Also affects go1.25
- CVE-2026-32280 During chain building, the amount of work that is done is not correctly limited when a… Also affects go1.25
- CVE-2026-32281 Validating certificate chains which use policies is unexpectedly inefficient when… Also affects go1.25
- CVE-2026-32283 If one side of the TLS connection sends multiple key update messages post-handshake in a… Also affects go1.25