CVE-2026-39817: Invoking "go tool pack" does not sanitize output paths in cmd/go

Analyzed

AliasesUBUNTU-CVE-2026-39817DEBIAN-CVE-2026-39817CGA-2249-9647-4pmv+7339 more

Published 07-05-2026Last modified 08-05-2026

Vulnerability summary

CVE-2026-39817 is a medium (CVSS 5.9) Out-of-bounds Write vulnerability in go toolchain cmd/go. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.17%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 17

OPENSUSE-SU-2026:10723-1 OPENSUSE-SU-2026:10741-1 OPENSUSE-SU-2026:21254-1 OPENSUSE-SU-2026:21319-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:22112+11 more

Timeline

07-05-2026
PublishedVulnerability first disclosed.
08-05-2026
Last modifiedVulnerability information updated.

Description

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.9

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r50 | < 0.4.12-r51
act< 0.2.88-r2
actions-runner-controller-fips< 0.14.1-r1 | < 0.14.1-r2
addon-resizer< 1.8.23-r19 | < 1.8.23-r18
addon-resizer-fips< 1.8.23-r18

age-fips< 1.3.1-r7 | < 1.3.1-r8
agentbeat< 9.2.7-r7
agentbeat-fips< 9.2.7-r7 | < 9.2.7-r6
amazon-cloudwatch-agent< 1.300067.0-r2 | < 1.300067.0-r3
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300067.0-r2 | < 1.300067.0-r3
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300067.0-r4
amazon-cloudwatch-agent-config-downloader< 1.300067.0-r3
amazon-cloudwatch-agent-config-downloader-fips< 1.300067.0-r4
amazon-cloudwatch-agent-config-translator< 1.300067.0-r3 | < 1.300067.0-r2
amazon-cloudwatch-agent-config-translator-fips< 1.300067.0-r4
amazon-cloudwatch-agent-fips< 1.300067.0-r4
amazon-cloudwatch-agent-operator< 3.4.2-r2
amazon-cloudwatch-agent-operator-fips< 3.4.2-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300067.0-r2
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300067.0-r4
amazon-ecs-agent-fips< 1.103.0-r1 | < 1.103.0-r0
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260306-r2
amazon-eks-ami< 20260318-r5
amazon-eks-ami-fips< 20260318-r3
amazon-k8s-cni< 1.21.1-r7 | < 1.21.1-r6
amazon-k8s-cni-fips< 1.21.1-r6
amazon-k8s-cni-init< 1.21.1-r7
amazon-k8s-cni-init-fips< 1.21.1-r6
amazon-k8s-cni-init-fips-compat< 1.21.1-r6
amazon-ssm-agent< 3.3.3270.0-r14
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r14
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r16 | < 3.3.3270.0-r15
amazon-ssm-agent-fips< 3.3.3270.0-r16
amazon-vpc-cni-plugins-fips< 1.3_git20260307-r1 | < 1.3_git20260307-r2
ansible-operator< 1.42.2-r4 | < 1.42.2-r5
ansible-operator-fips< 1.42.2-r5
apache-exporter< 1.0.12-r6
apko< 1.2.11-r2 | < 1.2.11-r1
apko-fips< 1.2.10-r1 | < 1.2.10-r0
apm-server-fips-8.19< 8.19.15-r4
apm-server-fips-9.1< 9.1.10-r7
apm-server-fips-9.2< 9.2.8-r2 | < 9.2.8-r3
apm-server-fips-9.3< 9.3.4-r0
apm-server-fips-9.4< 9.4.0-r1
argo-cd-3.3-compat< 3.3.9-r2
argo-cd-fips-3.0< 3.0.23-r7
argo-cd-fips-3.0-compat< 3.0.23-r7
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2< 3.2.11-r1 | < 3.2.11-r2
argo-cd-fips-3.2-compat< 3.2.11-r1
argo-cd-fips-3.3< 3.3.10-r0
argo-cd-fips-3.3-compat< 3.3.10-r0
argo-events< 1.9.10-r19 | < 1.9.10-r18
argo-events-fips< 1.9.10-r12 | < 1.9.10-r11
argo-rollouts-fips< 1.9.0-r6
argo-workflow-controller-3.6< 3.6.19-r7
argo-workflow-controller-3.7< 3.7.14-r1
argo-workflow-controller-4.0< 4.0.5-r2
argo-workflow-controller-fips-3.6< 3.6.19-r8
argo-workflow-controller-fips-3.7< 3.7.14-r0
argo-workflow-controller-fips-4.0< 4.0.5-r2 | < 4.0.5-r1
argo-workflow-executor-3.6< 3.6.19-r7
argo-workflow-executor-3.7< 3.7.14-r1
argo-workflow-executor-4.0< 4.0.5-r2
argo-workflow-executor-fips-3.6< 3.6.19-r7 | < 3.6.19-r8
argo-workflow-executor-fips-3.7< 3.7.14-r1 | < 3.7.14-r0
argo-workflow-executor-fips-4.0< 4.0.5-r2
argo-workflows-3.6< 3.6.19-r7
argo-workflows-3.7< 3.7.14-r1
argo-workflows-4.0< 4.0.5-r2
argo-workflows-fips-3.6< 3.6.19-r7 | < 3.6.19-r8
argo-workflows-fips-3.7< 3.7.14-r0
argo-workflows-fips-4.0< 4.0.5-r2
argocd-image-updater-fips< 1.2.0-r1 | < 1.2.0-r2
atlantis< 0.43.0-r0 | < 0.43.0-r1
atlantis-fips< 0.43.0-r2 | < 0.43.0-r3
atlas-1.0-fips< 1.0.0-r5
atlas-1.1-fips< 1.1.0-r3
auditbeat-8.17< 8.17.10-r17
auditbeat-8.19< 8.19.15-r2
auditbeat-9.0< 9.0.8-r18
auditbeat-9.1< 9.1.10-r12
auditbeat-9.2< 9.2.8-r5
auditbeat-9.3< 9.3.4-r2
auditbeat-fips-7< 7.17.29-r16 | < 7.17.29-r15
auditbeat-fips-8.17< 8.17.10-r17 | < 8.17.10-r16
auditbeat-fips-8.19< 8.19.15-r2
auditbeat-fips-9.0< 9.0.8-r19 | < 9.0.8-r20
auditbeat-fips-9.1< 9.1.10-r14
auditbeat-fips-9.2< 9.2.8-r5 | < 9.2.8-r6
auditbeat-fips-9.3< 9.3.4-r1 | < 9.3.4-r2
authentik-2025.12-go-server< 2025.12.4-r7 | < 2025.12.4-r8
authentik-fips-2025.12-go-server< 2025.12.4-r6
authentik-fips-2026.2-go-server< 2026.2.1-r6
authservice< 1.1.5-r8
authservice-fips< 1.1.5-r7
avmfix< 0.7.0-r1
avmfix-fips< 0.7.0-r1
aws-application-networking-k8s-fips< 2.0.2-r1
aws-ebs-csi-driver-1.52< 1.52.1-r11 | < 1.52.1-r10
aws-ebs-csi-driver-1.54< 1.54.0-r9 | < 1.54.0-r10
aws-ebs-csi-driver-fips-1.50< 1.50.3-r9
aws-ebs-csi-driver-fips-1.51< 1.51.2-r9 | < 1.51.2-r10
aws-ebs-csi-driver-fips-1.52< 1.52.1-r9
aws-ebs-csi-driver-fips-1.53< 1.53.0-r8 | < 1.53.0-r9
aws-ebs-csi-driver-fips-1.54< 1.54.0-r8 | < 1.54.0-r9
aws-ebs-csi-driver-fips-1.55< 1.55.0-r9
aws-ebs-csi-driver-fips-1.56< 1.56.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r1 | < 1.57.1-r2
aws-ebs-csi-driver-fips-1.58< 1.58.0-r1
aws-ebs-csi-driver-fips-1.59< 1.59.0-r0
aws-efs-csi-driver-fips< 3.1.0-r0 | < 3.1.0-r1
aws-eks-pod-identity-agent-fips< 0.1.37-r1 | < 0.1.37-r2
aws-flb-cloudwatch< 1.9.5-r1
aws-flb-cloudwatch-fips< 1.9.5-r0
aws-flb-firehose< 1.7.3-r1
aws-flb-firehose-fips< 1.7.3-r1
aws-flb-kinesis< 1.10.4-r1
aws-flb-kinesis-fips< 1.10.4-r0
aws-fsx-csi-driver-fips< 1.9.0-r1
aws-iam-authenticator< 0.7.15-r2
aws-iam-authenticator-fips< 0.7.15-r0
aws-lambda-runtime-interface-emulator< 1.35-r0
aws-load-balancer-controller-fips< 3.3.0-r0
aws-network-policy-agent-fips< 1.3.4-r0
aws-node-termination-handler-fips< 1.25.6-r4
aws-nuke-fips< 3.64.2-r0
aws-otel-collector< 0.47.0-r12
aws-otel-collector-fips< 0.47.0-r9
aws-otel-collector-healthcheck< 0.47.0-r12
aws-otel-collector-healthcheck-fips< 0.47.0-r9
aws-privateca-issuer-fips< 1.8.1-r2 | < 1.8.1-r3
aws-signer-notation-plugin-fips< 1.0.2292-r10
aws-sigv4-proxy-fips< 1.11.1-r6 | < 1.11.1-r5
azcopy-fips< 10.32.3-r1
azure-aad-pod-identity-mic< 1.8.17-r35 | < 1.8.17-r36
azure-aad-pod-identity-nmi< 1.8.17-r36
azure-service-operator< 2.19.0-r0
azure-service-operator-fips< 2.18.0-r6
azure-vnet-cni< 1.7.13-r2 | < 1.7.13-r1
azuredisk-csi-fips-1.31< 1.31.12-r13
azuredisk-csi-fips-1.32< 1.32.12-r9
azuredisk-csi-fips-1.33< 1.33.9-r1
azuredisk-csi-fips-1.34< 1.34.3-r1
azurefile-csi-fips-1.31< 1.31.8-r13 | All versions (No fix recorded)
azurefile-csi-fips-1.32< 1.32.9-r9 | < 1.32.9-r8
azurefile-csi-fips-1.33< 1.33.9-r1
azurefile-csi-fips-1.34< 1.34.5-r0
azurefile-csi-fips-1.35< 1.35.2-r1
backup-restore-operator-fips-10.0< 10.0.0-r2
backup-restore-operator-fips-7.0< 7.0.6-r1
backup-restore-operator-fips-8.1< 8.1.3-r2
backup-restore-operator-fips-9.0< 9.0.2-r1
bank-vaults-fips< 1.32.1-r9
bank-vaults-template-fips< 1.32.1-r8
bazelisk< 1.29.0-r0 | < 1.29.0-r1
bento-fips< 1.17.0-r3 | < 1.17.0-r4
blob-csi-fips-1.23< 1.23.11-r72
blob-csi-fips-1.24< 1.24.11-r19
blob-csi-fips-1.25< 1.25.10-r16 | < 1.25.10-r15
blob-csi-fips-1.26< 1.26.11-r0
blob-csi-fips-1.27< 1.27.4-r2
blobfuse2-fips< 2.4.2-r14
blobfuse2-fips-health-monitor< 2.4.2-r14
boring-registry-fips< 0.17.0-r3 | < 0.17.0-r2
boringssl-fips-static-2023042800-tools< 2023042800-r13
boringssl-fips-static-20240407-tools< 20240407-r5
buildah< 1.43.1-r3 | < 1.43.1-r2
buildah-fips< 1.43.1-r4 | < 1.43.1-r5
buildctl< 0.29.0-r9
buildctl-fips< 0.29.0-r3
buildkitd< 0.29.0-r8
buildkitd-fips< 0.29.0-r3
buildkite-agent< 3.126.0-r1
buildkite-agent-fips< 3.126.0-r1
buildtools-buildifier-fips< 8.5.1-r5
buildtools-buildozer-fips< 8.5.1-r4 | < 8.5.1-r5
caddy-fips< 2.11.2-r9
cadence< 1.4.0-r6
cadence-cassandra-tool< 1.4.0-r6
cadence-fips< 1.4.0-r5 | < 1.4.0-r6
cadence-fips-cassandra-tool< 1.4.0-r5 | < 1.4.0-r6
cadence-fips-server< 1.4.0-r6
cadence-fips-sql-tool< 1.4.0-r6
cadence-server< 1.4.0-r6
cadence-sql-tool< 1.4.0-r6
cadvisor-fips< 0.56.2-r7
calico-apiserver-fips-3.30< 3.30.7-r5
calico-apiserver-fips-3.31< 3.31.4-r9
calico-app-policy-3.30< 3.30.7-r6
calico-app-policy-fips-3.30< 3.30.7-r5
calico-app-policy-fips-3.31< 3.31.4-r9
calico-cni-fips-3.30< 3.30.7-r4 | < 3.30.7-r5
calico-cni-fips-3.31< 3.31.4-r8 | < 3.31.4-r9
calico-felix-3.30< 3.30.7-r6
calico-felix-fips-3.30< 3.30.7-r4 | < 3.30.7-r5
calico-felix-fips-3.31< 3.31.4-r9

Show all 198

Alpine2 products

go≥ 1.26.0, < 1.25.10-r0 | ≥ 1.26.0, < 1.26.3-r0
rclone< 1.74.1-r0

2 vendors · 200 products · Showing 200 of 3395

References

13 links

go.dev/issue/78778REPORTWEBIssue Tracking
go.dev/cl/767520REPORTWEBFIXPatch
groups.google.com/g/golang-announce/c/qcCIEXso47MREPORTWEBIssue TrackingMailing List
pkg.go.dev/vuln/GO-2026-4979REPORTWEBVendor Advisory
ubuntu.com/security/CVE-2026-39817REPORT
www.cve.org/CVERecord?id=CVE-2026-39817REPORT
go-review.googlesource.com/c/go/+/767520REPORT
github.com/golang/go/issues/78778REPORT
security-tracker.debian.org/tracker/CVE-2026-39817Advisory
pkg.go.devWEB

Show all 13 references