CVE-2026-27143

Description

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.54%• Percentile: 44%

Affected Systems

• chainguard•apache-beam-java-11-sdk

  < 2.73.0-r0

• chainguard•apache-beam-java-17-sdk

  < 2.73.0-r0

• chainguard•apache-beam-java-21-sdk

  < 2.73.0-r0

• chainguard•apisix-ingress-controller

  < 2.0.1-r10

• chainguard•apm-server-8.18

  all

• chainguard•apm-server-fips-8.18

  all

• chainguard•argo-cd-2.14

  all

• chainguard•argo-cd-2.14-compat

  all

• chainguard•argo-cd-3.0

  < 3.0.23-r5

• chainguard•argo-cd-3.0-compat

  < 3.0.23-r5

• chainguard•argo-cd-3.1

  < 3.1.13-r4

• chainguard•argo-cd-3.1-compat

  < 3.1.13-r4

• chainguard•argo-cd-3.3

  < 3.3.7-r0 | < 3.3.6-r4

• chainguard•argo-cd-3.3-compat

  < 3.3.7-r0

• chainguard•argo-cd-fips-2.14

  all

• chainguard•argo-cd-fips-2.14-compat

  all

• chainguard•argo-cd-fips-3.0

  < 3.0.23-r6

• chainguard•argo-cd-fips-3.0-compat

  < 3.0.23-r6

• chainguard•argo-cd-fips-3.2

  < 3.2.8-r5

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.8-r5

• chainguard•argo-rollouts

  < 1.9.0-r7

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r6

• chainguard•argo-workflow-controller-fips-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r6

• chainguard•argo-workflow-executor-fips-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-3.6

  < 3.6.19-r6

• chainguard•argo-workflows-fips-3.6

  < 3.6.19-r7

• chainguard•atlantis

  < 0.42.0-r0

• chainguard•auditbeat-7

  < 7.17.29-r13

• chainguard•auditbeat-8.18

  all

• chainguard•auditbeat-fips-7

  < 7.17.29-r15

• chainguard•auditbeat-fips-8.18

  all

• chainguard•aws-application-networking-k8s

  < 2.0.2-r8

• chainguard•aws-eks-pod-identity-agent-fips

  < 0.1.37-r1

• chainguard•aws-flb-cloudwatch-fips

  < 1.9.4-r23

• chainguard•aws-flb-firehose-fips

  < 1.7.2-r23

• chainguard•aws-flb-kinesis-fips

  < 1.10.3-r10

• chainguard•aws-sigv4-proxy-fips

  < 1.11.1-r5

• chainguard•azuredisk-csi-1.31

  < 1.31.12-r13

• chainguard•azuredisk-csi-fips-1.31

  < 1.31.12-r13

• chainguard•azurefile-csi-1.31

  < 1.31.8-r12

• chainguard•azurefile-csi-1.32

  < 1.32.9-r10

• chainguard•azurefile-csi-fips-1.31

  < 1.31.8-r13

• chainguard•azurefile-csi-fips-1.32

  < 1.32.9-r8

• chainguard•blobfuse2

  < 2.4.2-r13

• chainguard•blobfuse2-fips

  < 2.4.2-r12

• chainguard•blobfuse2-fips-health-monitor

  < 2.4.2-r12

• chainguard•blobfuse2-health-monitor

  < 2.4.2-r13

• chainguard•boringssl-fips-static-2023042800-tools

  < 2023042800-r12

• chainguard•boringssl-fips-static-20240407-tools

  < 20240407-r4

Showing first 50 affected entries in server-rendered view.

References (8)

• https://go.dev/cl/763765
• https://go.dev/issue/78333
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• https://pkg.go.dev/vuln/GO-2026-4868
• https://security-tracker.debian.org/tracker/CVE-2026-27143
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27143.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143