CVE-2026-27143 json
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
published 2026-04-07 7 mo ago modified 2026-09-08 2 mo ago also BIT-golang-2026-27143 , EUVD-2026-20004 , GO-2026-4868
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Patch / fix
- bitnami golang 1.25.9, 1.26.2
- go toolchain 1.25.9, 1.26.2
- Go toolchain cmd/compile 1.25.9, 1.26.2
- golang-1.26 Debian 14 1.26.2-1
debian advisories DEBIAN-CVE-2026-27143
- golang1.25 hummingbird 1 1.25.9-1.hum1
- golang1.25-bin hummingbird 1 1.25.9-1.hum1
- golang1.25-src hummingbird 1 1.25.9-1.hum1
- golang1.25-misc hummingbird 1 1.25.9-1.hum1
- golang1.25-tests hummingbird 1 1.25.9-1.hum1
- golang1.25-shared hummingbird 1 1.25.9-1.hum1
- golang1.26 hummingbird 1 1.26.2-1.hum1
- golang1.26-bin hummingbird 1 1.26.2-1.hum1
red hat advisories RHSA-2026:47719RHSA-2026:47712RHSA-2026:7385RHSA-2026:7291RHSA-2026:16024RHSA-2026:16021
- go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.12-160000.1.1
- go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.4-160000.1.1
- go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.9-150000.1.21.1
- go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.2-150000.1.6.1
- go1.25 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.25.9-150000.1.35.1
- go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.2-150000.1.9.1
suse advisories SUSE-SU-2026:22638-1SUSE-SU-2026:22572-1SUSE-SU-2026:1581-1SUSE-SU-2026:1580-1SUSE-SU-2026:1321-1SUSE-SU-2026:1320-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- go1.25-openssl openSUSE Leap 16.0 1.25.12-160000.1.1
- go1.26-openssl openSUSE Leap 16.0 1.26.4-160000.1.1
- kpt-cli openSUSE Tumbleweed 1.0.0~beta.64-1.1
- go1.26 openSUSE Leap 16.0 1.26.2-160000.1.1
- go1.25 openSUSE Leap 16.0 1.25.9-160000.1.1
- go1.26 openSUSE Tumbleweed 1.26.2-1.1
- go1.25 openSUSE Tumbleweed 1.25.9-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21319-1openSUSE-SU-2026:21254-1openSUSE-SU-2026:10894-1openSUSE-SU-2026:20571-1openSUSE-SU-2026:20570-1
- delve AlmaLinux 8 1.25.2-1.module_el8.10.0+4074+24330916
- golang AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- go-toolset AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- golang-bin AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- golang-src AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- golang-misc AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- golang-race AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
- golang-tests AlmaLinux 8 1.25.9-1.module_el8.10.0+4167+2e2e20dd
almalinux advisories ALSA-2026:10704
- golang Rocky Linux 10 1.25.9-3.el10_1
- golang Rocky Linux 9 1.25.9-1.el9_7
- delve Rocky Linux 8 1.25.2-1.module+el8.10.0+40035+ee0a7047
- golang Rocky Linux 8 1.25.9-1.module+el8.10.0+40168+6cb0ea60
rocky linux advisories RLSA-2026:10217RLSA-2026:10219RLSA-2026:10704
- go Alpine 3.23 1.25.9-r0
- go Alpine 3.24 1.26.2-r0
- rclone Alpine 3.24 1.73.5-r0
alpine advisories ALPINE-CVE-2026-27143
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go.dev/cl/763765 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-27143 updated cvss 8.1
golang: cmd/compile: possible memory corruption after bound check elimination
-
Red Hat OpenShift Service Mesh 2 openshift-service-mesh/proxyv2-rhel9 Red Hat Enterprise Linux 9 go-toolset Red Hat Enterprise Linux AI (RHEL AI) 3 golang Red Hat OpenShift Container Platform 4 ossm-2/openshift-golang-builder-container Red Hat OpenShift Virtualization 4 ossm-2/openshift-golang-builder-containeraffected: workaround, no fix available
-
Red Hat Enterprise Linux AppStream (v. 8) delve 1.25.2-1.module+el8.10.0+23746+9db33b5e, golang 1.25.9-1.module+el8.10.0+24226+c418b32c, go-toolset 1.25.9-1.module+el8.10.0+24226+c418b32c, golang-bin 1.25.9-1.module+el8.10.0+24226+c418b32c, golang-src 1.25.9-1.module+el8.10.0+24226+c418b32c, golang-misc 1.25.9-1.module+el8.10.0+24226+c418b32c, +2 morefixed: vendor fix RHSA-2026:10704
-
Red Hat Enterprise Linux AppStream (v. 9) golang 1.25.9-1.el9_7, go-toolset 1.25.9-1.el9_7, golang-bin 1.25.9-1.el9_7, golang-src 1.25.9-1.el9_7, golang-misc 1.25.9-1.el9_7, golang-race 1.25.9-1.el9_7, +1 morefixed: vendor fix RHSA-2026:10219
-
Red Hat Enterprise Linux AppStream (v. 10) golang 1.25.9-3.el10_1, go-toolset 1.25.9-3.el10_1, golang-bin 1.25.9-3.el10_1, golang-src 1.25.9-3.el10_1, golang-misc 1.25.9-3.el10_1, golang-race 1.25.9-3.el10_1, +1 morefixed: vendor fix RHSA-2026:10217
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c, golang 1.26.10-2.module+el8.4.0+25201+9a419e96, go-toolset 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-bin 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-src 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-misc 1.26.10-2.module+el8.4.0+25201+9a419e96, +2 morefixed: vendor fix RHSA-2026:90994
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) delve 1.26.1-1.module+el8.6.0+24782+a062e766, golang 1.26.10-4.module+el8.6.0+25114+90ecdb41, go-toolset 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-bin 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-src 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-misc 1.26.10-4.module+el8.6.0+25114+90ecdb41, +2 morefixed: vendor fix RHSA-2026:87246
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) delve 1.26.1-1.module+el8.8.0+24781+86ad105d, golang 1.26.10-4.module+el8.8.0+25113+a148ecc0, go-toolset 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-bin 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-src 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-misc 1.26.10-4.module+el8.8.0+25113+a148ecc0, +2 morefixed: vendor fix RHSA-2026:87245
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) golang 1.25.9-1.el9_2, go-toolset 1.25.9-1.el9_2, golang-bin 1.25.9-1.el9_2, golang-src 1.25.9-1.el9_2, golang-misc 1.25.9-1.el9_2, golang-race 1.25.9-1.el9_2, +1 morefixed: vendor fix RHSA-2026:47719
show 22 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) golang 1.25.9-1.el9_4, go-toolset 1.25.9-1.el9_4, golang-bin 1.25.9-1.el9_4, golang-src 1.25.9-1.el9_4, golang-misc 1.25.9-1.el9_4, golang-tests 1.25.9-1.el9_4fixed: vendor fix RHSA-2026:47712
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) golang 1.25.9-1.el10_0, go-toolset 1.25.9-1.el10_0, golang-bin 1.25.9-1.el10_0, golang-src 1.25.9-1.el10_0, golang-misc 1.25.9-1.el10_0, golang-race 1.25.9-1.el10_0, +1 morefixed: vendor fix RHSA-2026:16024
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) golang 1.25.9-1.el9_6, go-toolset 1.25.9-1.el9_6, golang-bin 1.25.9-1.el9_6, golang-src 1.25.9-1.el9_6, golang-misc 1.25.9-1.el9_6, golang-race 1.25.9-1.el9_6, +1 morefixed: vendor fix RHSA-2026:16021
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve 1.26.1-1.module+el8.4.0+25181+7ce5b91c, golang 1.26.10-2.module+el8.4.0+25201+9a419e96, go-toolset 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-bin 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-src 1.26.10-2.module+el8.4.0+25201+9a419e96, golang-misc 1.26.10-2.module+el8.4.0+25201+9a419e96, +2 morefixed: vendor fix RHSA-2026:90994
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve 1.26.1-1.module+el8.6.0+24782+a062e766, golang 1.26.10-4.module+el8.6.0+25114+90ecdb41, go-toolset 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-bin 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-src 1.26.10-4.module+el8.6.0+25114+90ecdb41, golang-misc 1.26.10-4.module+el8.6.0+25114+90ecdb41, +2 morefixed: vendor fix RHSA-2026:87246
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) delve 1.26.1-1.module+el8.8.0+24781+86ad105d, golang 1.26.10-4.module+el8.8.0+25113+a148ecc0, go-toolset 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-bin 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-src 1.26.10-4.module+el8.8.0+25113+a148ecc0, golang-misc 1.26.10-4.module+el8.8.0+25113+a148ecc0, +2 morefixed: vendor fix RHSA-2026:87245
-
Red Hat Hardened Images golang1.25 1.25.9-1.hum1, golang1.26 1.26.2-1.hum1, golang1.25-bin 1.25.9-1.hum1, golang1.25-src 1.25.9-1.hum1, golang1.26-bin 1.26.2-1.hum1, golang1.26-src 1.26.2-1.hum1, +6 morefixed: vendor fix RHSA-2026:7385
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli 1786751663, openshift4/ose-pod 1786752253, openshift4/ose-etcd 1786751853, openshift4/ose-tests 1787572232, openshift4/ose-console 1786753387, openshift4/ose-coredns 1786752378, +173 morefixed: vendor fix RHSA-2026:59833
-
Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli 1788844840, openshift4/ose-pod 1788845139, openshift4/ose-tests 1788847200, openshift4/ose-console 1788900680, openshift4/ose-coredns 1788845087, openshift4/ose-hyperkube 1788845350, +174 morefixed: vendor fix RHSA-2026:65840
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1781822479, openshift4/ose-pod 1781829374, openshift4/ose-tests 1782189317, openshift4/ose-console 1782157414, openshift4/ose-coredns 1781822636, openshift4/ose-installer 1781823409, +180 morefixed: vendor fix RHSA-2026:28893
-
Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1781813947, openshift4/ose-tests 1782127009, openshift4/ose-console 1782127091, openshift4/ose-installer 1781868012, openshift4/ose-pod-rhel9 1781928057, openshift4/ose-sdn-rhel9 1781930683, +176 morefixed: vendor fix RHSA-2026:28964
-
Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1786785721, openshift4/ose-pod-rhel9 1786788191, openshift4/ose-sdn-rhel9 1786788280, openshift4/ose-etcd-rhel9 1786787038, openshift4/ose-tools-rhel9 1786784972, openshift4/ose-thanos-rhel9 1786785074, +173 morefixed: vendor fix RHSA-2026:56854
-
Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1782184905, openshift4/ose-cli-rhel9 1782186366, openshift4/ose-pod-rhel9 1782186811, openshift4/ose-etcd-rhel9 1782185530, openshift4/ose-tests-rhel9 1782191912, openshift4/ose-tools-rhel9 1782185868, +173 morefixed: vendor fix RHSA-2026:34099
-
Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1779778465, openshift4/ose-cli-rhel9 1779780731, openshift4/ose-pod-rhel9 1779786458, openshift4/ose-etcd-rhel9 1779785143, openshift4/ose-tests-rhel9 1779788300, openshift4/ose-tools-rhel9 1779860157, +173 morefixed: vendor fix RHSA-2026:21657
-
Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1779250510, openshift4/ose-cli-rhel9 1779252397, openshift4/ose-pod-rhel9 1779258884, openshift4/ose-etcd-rhel9 1779252012, openshift4/ose-tests-rhel9 1779266169, openshift4/ose-tools-rhel9 1779249892, +173 morefixed: vendor fix RHSA-2026:20041
-
Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh 1777319773, openshift-service-mesh 1777319850, openshift-service-mesh 1777320087, openshift-service-mesh 1777374598fixed: vendor fix RHSA-2026:11688
-
Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 1777883393, openshift-service-mesh 1777883471, openshift-service-mesh 1777984344, openshift-service-mesh 1778149127fixed: vendor fix RHSA-2026:16477
-
Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh 1777884022, openshift-service-mesh 1777884045, openshift-service-mesh 1778125216, openshift-service-mesh 1778149657fixed: vendor fix RHSA-2026:16505
-
Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh 1778007366, openshift-service-mesh 1778007597, openshift-service-mesh 1778103735, openshift-service-mesh 1778150474fixed: vendor fix RHSA-2026:16508
-
Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh 1778007548, openshift-service-mesh 1778007569, openshift-service-mesh 1778012399fixed: vendor fix RHSA-2026:16537
-
Red Hat OpenShift Service Mesh 2 ossm-2/openshift-golang-builder-container Red Hat OpenShift Service Mesh 3 ossm-2/openshift-golang-builder-containernot affected: component not present
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-deployer 1786753558, openshift4/ose-tools-rhel8 1787571336, openshift4/ose-ironic-rhel9 1787546039, openshift4/ose-haproxy-router 1786752334, openshift4/driver-toolkit-rhel8 1787571346, openshift4/ose-ironic-agent-rhel9 1787546025, +5 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-deployer 1788845947, openshift4/ose-tools-rhel8 1788846274, openshift4/ose-ironic-rhel9 1788557796, openshift4/ose-haproxy-router 1788845963, openshift4/driver-toolkit-rhel9 1788843578, openshift4/ose-ironic-agent-rhel9 1788557578, +5 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-deployer 1781830664, openshift4/ose-tools-rhel8 1782127613, openshift4/ose-ironic-rhel9 1782216022, openshift4/ose-haproxy-router 1781832015, openshift4/driver-toolkit-rhel9 1782218018, openshift4/ose-ironic-agent-rhel9 1782215971, +6 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-deployer 1781822405, openshift4/ose-tools-rhel8 1782125686, openshift4/ose-ironic-rhel9 1781926067, openshift4/ose-haproxy-router 1781814236, openshift4/driver-toolkit-rhel9 1781928044, openshift4/ose-ironic-agent-rhel9 1781926059, +5 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-ironic-rhel9 1787053253, openshift4/ose-deployer-rhel9 1786789357, openshift4/driver-toolkit-rhel9 1786994815, openshift4/ose-ironic-agent-rhel9 1786784721, openshift4/ose-haproxy-router-rhel9 1786786054, openshift4/ose-machine-os-images-rhel9 1786794568, +5 more Red Hat OpenShift Container Platform 4.17 openshift4/ose-ironic-rhel9 1782184858, openshift4/ose-deployer-rhel9 1782191617, openshift4/driver-toolkit-rhel9 1782467295, openshift4/ose-ironic-agent-rhel9 1782184868, openshift4/ose-haproxy-router-rhel9 1782191673, openshift4/ose-machine-os-images-rhel9 1782196977, +4 morenot affected: vulnerable code not present
7 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.25.9 >=1.26.0, <1.26.2 |
1.25.9 1.26.2 |
| go | toolchain | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
Affected products
- Go toolchain cmd/compile
References
-
go.dev
/cl/763765
patch
-
pkg.go.dev
/vuln/GO-2026-4868
vendor-advisory, advisory
-
go.dev
/issue/78333
issue-tracking, report
-
groups.google.com
/g/golang-announce/c/0uYbvbPZRWU
mailing-list, release-notes, discussion, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-27143
web
Sources
- CVE List CVE-2026-27143
- NVD CVE-2026-27143
- OSV BIT-golang-2026-27143
- OSV GO-2026-4868
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.