CVE-2026-39817
Vulnerability Summary
Timeline
Description
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
EPSS Trends
Current EPSS score: 0.17%• Percentile: 7%
Techniques & Countermeasures
- CWE-787•Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Affected Systems
- chainguard•aactl
< 0.4.12-r50 | < 0.4.12-r51
- chainguard•act
< 0.2.88-r2
- chainguard•actions-runner-controller-fips
< 0.14.1-r1 | < 0.14.1-r2
- chainguard•addon-resizer
< 1.8.23-r19 | < 1.8.23-r18
- chainguard•addon-resizer-fips
< 1.8.23-r18
- chainguard•age-fips
< 1.3.1-r7 | < 1.3.1-r8
- chainguard•agentbeat
< 9.2.7-r7
- chainguard•agentbeat-fips
< 9.2.7-r7 | < 9.2.7-r6
- chainguard•amazon-cloudwatch-agent
< 1.300067.0-r2 | < 1.300067.0-r3
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard
< 1.300067.0-r2 | < 1.300067.0-r3
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 1.300067.0-r4
- chainguard•amazon-cloudwatch-agent-config-downloader
< 1.300067.0-r3
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 1.300067.0-r4
- chainguard•amazon-cloudwatch-agent-config-translator
< 1.300067.0-r3 | < 1.300067.0-r2
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 1.300067.0-r4
- chainguard•amazon-cloudwatch-agent-fips
< 1.300067.0-r4
- chainguard•amazon-cloudwatch-agent-operator
< 3.4.2-r2
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.4.2-r1
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent
< 1.300067.0-r2
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 1.300067.0-r4
- chainguard•amazon-ecs-agent-fips
< 1.103.0-r1 | < 1.103.0-r0
- chainguard•amazon-ecs-cni-plugins-fips
< 2024.9.0_git20260306-r2
- chainguard•amazon-eks-ami
< 20260318-r5
- chainguard•amazon-eks-ami-fips
< 20260318-r3
- chainguard•amazon-k8s-cni
< 1.21.1-r7 | < 1.21.1-r6
- chainguard•amazon-k8s-cni-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init
< 1.21.1-r7
- chainguard•amazon-k8s-cni-init-fips
< 1.21.1-r6
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.21.1-r6
- chainguard•amazon-ssm-agent
< 3.3.3270.0-r14
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.3270.0-r14
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 3.3.3270.0-r16 | < 3.3.3270.0-r15
- chainguard•amazon-ssm-agent-fips
< 3.3.3270.0-r16
- chainguard•amazon-vpc-cni-plugins-fips
< 1.3_git20260307-r1 | < 1.3_git20260307-r2
- chainguard•ansible-operator
< 1.42.2-r4 | < 1.42.2-r5
- chainguard•ansible-operator-fips
< 1.42.2-r5
- chainguard•apache-exporter
< 1.0.12-r6
- chainguard•apko
< 1.2.11-r2 | < 1.2.11-r1
- chainguard•apko-fips
< 1.2.10-r1 | < 1.2.10-r0
- chainguard•apm-server-fips-8.19
< 8.19.15-r4
- chainguard•apm-server-fips-9.1
< 9.1.10-r7
- chainguard•apm-server-fips-9.2
< 9.2.8-r2 | < 9.2.8-r3
- chainguard•apm-server-fips-9.3
< 9.3.4-r0
- chainguard•apm-server-fips-9.4
< 9.4.0-r1
- chainguard•argo-cd-3.3-compat
< 3.3.9-r2
- chainguard•argo-cd-fips-3.0
< 3.0.23-r7
- chainguard•argo-cd-fips-3.0-compat
< 3.0.23-r7
- chainguard•argo-cd-fips-3.1
< 3.1.16-r1
- chainguard•argo-cd-fips-3.1-compat
< 3.1.16-r1
- chainguard•argo-cd-fips-3.2
< 3.2.11-r1 | < 3.2.11-r2
Showing first 50 affected entries in server-rendered view.
References (8)
- https://go.dev/issue/78778
- https://go.dev/cl/767520
- https://groups.google.com/g/golang-announce/c/qcCIEXso47M
- https://pkg.go.dev/vuln/GO-2026-4979
- https://security-tracker.debian.org/tracker/CVE-2026-39817
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39817.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-39817