CVE-2026-39819
Medium · 5.3CVSS
5.3
EPSS
0.1%
Published
May 7, 2026
CISA due date
—
The record
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | go1.25 | 0 | 1.25.10-1.1 |
| openSUSE:Tumbleweed | go1.26 | 0 | 1.26.3-1.1 |
Related vulnerabilities
- CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects go1.25
- CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects go1.25
- CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects go1.25
- CVE-2026-42501 A malicious module proxy can exploit a flaw in the go command's validation of module… Also affects go1.25
- CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address… Also affects go1.25
- CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to… Also affects go1.25
- CVE-2026-39826 If a trusted template author were to write a tag containing an empty 'type' attribute or… Also affects go1.25
- CVE-2026-39836 The Dial and LookupPort functions panic on Windows when provided with an input containing… Also affects go1.25