CVE-2026-27143: Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Analyzed

AliasesUBUNTU-CVE-2026-27143DEBIAN-CVE-2026-27143CGA-228w-fp99-ccjv+2623 more

Published 08-04-2026Last modified 13-04-2026

Vulnerability summary

CVE-2026-27143 is a critical (CVSS 9.8) vulnerability in go toolchain cmd/compile. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 04-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.54%

0%100%

Low · -0.13 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

08-04-2026
PublishedVulnerability first disclosed.
13-04-2026
Last modifiedVulnerability information updated.

Description

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

CVSS metrics

7 scores · 7 sources · 1 version

v3.19.8

EPSS trend

Probability

0.54%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Decrease -0.13 pp

From 0.66% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

apache-beam-java-11-sdk< 2.73.0-r0
apache-beam-java-17-sdk< 2.73.0-r0
apache-beam-java-21-sdk< 2.73.0-r0
apisix-ingress-controller< 2.0.1-r10
apm-server-8.18All versions (No fix recorded)

apm-server-fips-8.18All versions (No fix recorded)
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0< 3.0.23-r5
argo-cd-3.0-compat< 3.0.23-r5
argo-cd-3.1< 3.1.13-r4
argo-cd-3.1-compat< 3.1.13-r4
argo-cd-3.3< 3.3.7-r0 | < 3.3.6-r4
argo-cd-3.3-compat< 3.3.7-r0
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r6
argo-cd-fips-3.0-compat< 3.0.23-r6
argo-cd-fips-3.2< 3.2.8-r5
argo-cd-fips-3.2-compat< 3.2.8-r5
argo-rollouts< 1.9.0-r7
argo-workflow-controller-3.6< 3.6.19-r6
argo-workflow-controller-fips-3.6< 3.6.19-r7
argo-workflow-executor-3.6< 3.6.19-r6
argo-workflow-executor-fips-3.6< 3.6.19-r7
argo-workflows-3.6< 3.6.19-r6
argo-workflows-fips-3.6< 3.6.19-r7
atlantis< 0.42.0-r0
auditbeat-7< 7.17.29-r13
auditbeat-8.18All versions (No fix recorded)
auditbeat-fips-7< 7.17.29-r15
auditbeat-fips-8.18All versions (No fix recorded)
aws-application-networking-k8s< 2.0.2-r8
aws-eks-pod-identity-agent-fips< 0.1.37-r1
aws-flb-cloudwatch-fips< 1.9.4-r23
aws-flb-firehose-fips< 1.7.2-r23
aws-flb-kinesis-fips< 1.10.3-r10
aws-sigv4-proxy-fips< 1.11.1-r5
azuredisk-csi-1.31< 1.31.12-r13
azuredisk-csi-fips-1.31< 1.31.12-r13
azurefile-csi-1.31< 1.31.8-r12
azurefile-csi-1.32< 1.32.9-r10
azurefile-csi-fips-1.31< 1.31.8-r13
azurefile-csi-fips-1.32< 1.32.9-r8
blobfuse2< 2.4.2-r13
blobfuse2-fips< 2.4.2-r12
blobfuse2-fips-health-monitor< 2.4.2-r12
blobfuse2-health-monitor< 2.4.2-r13
boringssl-fips-static-2023042800-tools< 2023042800-r12
boringssl-fips-static-20240407-tools< 20240407-r4
buf< 1.68.3-r0
buildkite-agent< 3.123.1-r0
buildkite-agent-fips< 3.123.1-r0
cadvisor< 0.56.2-r15
calico-apiserver-fips-3.29All versions (No fix recorded)
calico-apiserver-fips-3.30< 3.30.7-r2
calico-apiserver-fips-3.31< 3.31.4-r6
calico-app-policy-fips-3.29All versions (No fix recorded)
calico-app-policy-fips-3.30< 3.30.7-r2
calico-app-policy-fips-3.31< 3.31.4-r6
calico-cni-fips-3.29All versions (No fix recorded)
calico-cni-fips-3.30< 3.30.7-r2
calico-cni-fips-3.31< 3.31.4-r6
calico-felix-fips-3.29All versions (No fix recorded)
calico-felix-fips-3.30< 3.30.7-r2
calico-felix-fips-3.31< 3.31.4-r6
calico-goldmane-fips-3.30< 3.30.7-r2
calico-goldmane-fips-3.31< 3.31.4-r6
calico-key-cert-provisioner-fips-3.29All versions (No fix recorded)
calico-key-cert-provisioner-fips-3.30< 3.30.7-r2
calico-key-cert-provisioner-fips-3.31< 3.31.4-r6
calico-kube-controllers-fips-3.29All versions (No fix recorded)
calico-kube-controllers-fips-3.30< 3.30.7-r2
calico-kube-controllers-fips-3.31< 3.31.4-r6
calico-node-fips-3.29All versions (No fix recorded)
calico-node-fips-3.30< 3.30.7-r2
calico-node-fips-3.31< 3.31.4-r6
calico-pod2daemon-fips-3.29All versions (No fix recorded)
calico-pod2daemon-fips-3.30< 3.30.7-r2
calico-pod2daemon-fips-3.31< 3.31.4-r6
calico-typha-client-fips-3.29All versions (No fix recorded)
calico-typha-client-fips-3.30< 3.30.7-r2
calico-typha-client-fips-3.31< 3.31.4-r6
calico-typhad-fips-3.29All versions (No fix recorded)
calico-typhad-fips-3.30< 3.30.7-r2
calico-typhad-fips-3.31< 3.31.4-r6
calico-whisker-backend-fips-3.30< 3.30.7-r2
calico-whisker-backend-fips-3.31< 3.31.4-r6
calicoctl-fips-3.29All versions (No fix recorded)
calicoctl-fips-3.30< 3.30.7-r2
calicoctl-fips-3.31< 3.31.4-r6
cephcsi< 3.16.2-r3
cert-manager-1.18< 1.18.6-r4
cert-manager-acmesolver-1.18< 1.18.6-r4
cert-manager-acmesolver-fips-1.18< 1.18.6-r2
cert-manager-cainjector-1.18< 1.18.6-r4
cert-manager-cainjector-fips-1.18< 1.18.6-r2
cert-manager-controller-1.18< 1.18.6-r4
cert-manager-controller-fips-1.18< 1.18.6-r2
cert-manager-fips-1.18< 1.18.6-r2
cert-manager-startupapicheck-1.18< 1.18.6-r4
cert-manager-startupapicheck-fips-1.18< 1.18.6-r2
cert-manager-webhook-1.18< 1.18.6-r4
cert-manager-webhook-fips-1.18< 1.18.6-r2
cilium-1.16< 1.16.19-r8
cilium-1.16-clustermesh-apiserver< 1.16.19-r8
cilium-1.16-hubble-relay< 1.16.19-r8
cilium-1.16-operator-aws< 1.16.19-r8
cilium-1.16-operator-generic< 1.16.19-r8
cilium-envoy-1.16All versions (No fix recorded)
cilium-envoy-fips-1.16All versions (No fix recorded)
cilium-fips-1.16< 1.16.19-r7
cilium-fips-1.16-clustermesh-apiserver< 1.16.19-r7
cilium-fips-1.16-host-utils< 1.16.19-r7
cilium-fips-1.16-hubble-relay< 1.16.19-r7
cilium-fips-1.16-operator-aws< 1.16.19-r7
cilium-fips-1.16-operator-azure< 1.16.19-r7
cilium-fips-1.16-operator-generic< 1.16.19-r7
cloud-provider-aws-1.31-cloud-controller-manager< 1.31.9-r12
cloud-provider-aws-1.31-ecr-credential-provider< 1.31.9-r12
cloud-provider-aws-1.32-cloud-controller-manager< 1.32.7-r2
cloud-provider-aws-1.32-ecr-credential-provider< 1.32.7-r2
cloud-provider-aws-fips-1.31-cloud-controller-manager< 1.31.9-r10
cloud-provider-aws-fips-1.31-ecr-credential-provider< 1.31.9-r10
cloud-provider-aws-fips-1.32-cloud-controller-manager< 1.32.7-r2
cloud-provider-aws-fips-1.32-ecr-credential-provider< 1.32.7-r2
cloud-provider-aws-fips-1.33-cloud-controller-manager< 1.33.3-r2
cloud-provider-aws-fips-1.33-ecr-credential-provider< 1.33.3-r2
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.12-r11
cloud-provider-azure-cloud-controller-manager-fips-1.31< 1.31.12-r10
cloud-provider-azure-cloud-controller-manager-fips-1.34< 1.34.8-r1
cloud-provider-azure-cloud-node-manager-1.31< 1.31.12-r11
cloud-provider-azure-cloud-node-manager-fips-1.31< 1.31.12-r10
cloud-provider-azure-cloud-node-manager-fips-1.34< 1.34.8-r1
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-9.3< 9.3.3-r1
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-8.19< 8.19.13-r5
cluster-api-fips-1.9-capd-manager< 1.9.11-r12
cluster-api-fips-1.9-clusterctl< 1.9.11-r12
cluster-api-fips-1.9-controller< 1.9.11-r12
cluster-api-fips-1.9-kubeadm-bootstrap-controller< 1.9.11-r12
cluster-api-fips-1.9-kubeadm-control-plane-controller< 1.9.11-r12
cni-plugins< 1.9.1-r3
cni-plugins-aws-k8s-compat< 1.9.1-r3
cni-plugins-bandwidth< 1.9.1-r3
cni-plugins-bridge< 1.9.1-r3
cni-plugins-dhcp< 1.9.1-r3
cni-plugins-dummy< 1.9.1-r3
cni-plugins-firewall< 1.9.1-r3
cni-plugins-host-device< 1.9.1-r3
cni-plugins-host-local< 1.9.1-r3
cni-plugins-ipam< 1.9.1-r3
cni-plugins-ipvlan< 1.9.1-r3
cni-plugins-loopback< 1.9.1-r3
cni-plugins-macvlan< 1.9.1-r3
cni-plugins-main< 1.9.1-r3
cni-plugins-meta< 1.9.1-r3
cni-plugins-portmap< 1.9.1-r3
cni-plugins-ptp< 1.9.1-r3
cni-plugins-sbr< 1.9.1-r3
cni-plugins-static< 1.9.1-r3
cni-plugins-tap< 1.9.1-r3
cni-plugins-tuning< 1.9.1-r3
cni-plugins-vlan< 1.9.1-r3
cni-plugins-vrf< 1.9.1-r3
commercial-chainloop-backend< 1.61.1-r0
commercial-expanso-edge< 2.1.19-r0
commercial-grafana-11.6< 11.6.16-r0
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2< 12.2.10-r0
commercial-grafana-12.3< 12.3.8-r0
commercial-grafana-12.4< 12.4.3-r0
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
consul-1.18< 1.18.2-r49
consul-1.19< 1.19.2-r48
consul-1.21< 1.21.5-r12
consul-1.22< 1.22.6-r2
consul-fips-1.19All versions (No fix recorded)
consul-fips-1.21< 1.21.5-r14
container-object-storage-interface-controller< 0.2.2-r13
container-object-storage-interface-sidecar< 0.2.2-r13
coredns-1.13< 1.13.2-r4
coredns-fips-1.13< 1.13.2-r5

Show all 198

Alpine2 products

go≥ 1.26.0, < 1.25.9-r0 | ≥ 1.26.0, < 1.26.2-r0
rclone< 1.73.5-r0

2 vendors · 200 products · Showing 200 of 1090

References

12 links

go.dev/cl/763765REPORTWEBFIXPatch
go.dev/issue/78333REPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/0uYbvbPZRWUREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2026-4868REPORTWEBVendor Advisory
ubuntu.com/security/CVE-2026-27143REPORT
www.cve.org/CVERecord?id=CVE-2026-27143REPORT
security-tracker.debian.org/tracker/CVE-2026-27143Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27143.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-27143Advisory

Show all 12 references