Go 1.27.4 and 1.26.11 patch 12 security flaws including cgo build-time code execution vulnerabilities

Entenda a falha

A vulnerabilidade

Go 1.26.0 to 1.26.10 and 1.27.0 to 1.27.3 have 12 CVEs, fixed in 1.26.11 and 1.27.4. Eleven are in the toolchain (CVE-2026-97033 to CVE-2026-97043): a malicious Go package using cgo directives, linker flags or crafted object files can run code on the machine that builds it, on Linux, macOS and Windows. The attacker needs the victim to build a poisoned dependency, for example on a laptop or CI runner, and gets code execution with access to build secrets and signing keys. The twelfth, CVE-2026-97054, is in net/http: a race in the HTTP/1 MaxBytesReader can crash a server. The CVE records have no CVSS scores yet.

Como funciona

During go build, a package can pass flags to the C compiler and linker through #cgo directives, and Go filters them against an allowlist. It also processes .syso files, pkg-config output and //go:cgo_* pragmas. Some flags and inputs get past the filtering, so the compiler or linker is pointed at attacker-controlled tools, spec files, scripts or plugin libraries, and the build runs the attacker's code. On macOS, the Apple linker rejoins split -l and to_library arguments into a flag that loads an arbitrary LTO plugin. For the net/http bug, when MaxBytesReader reaches its limit it sets a Connection: close header without locking, while the handler may be writing headers during the body read, which causes a runtime panic.

Por que é vulnerável

For the toolchain flaws, the cause is incomplete validation of untrusted build inputs: the cgo flag allowlist and the handling of linker arguments, object files, pkg-config directives, pragmas, DLL names and escaped quotes let dangerous options through, and the build trusts them. The net/http flaw is a missing synchronization: a header is modified without a lock. The articles do not detail the exact code changes in the fixes.

Onde está

The articles name the cgo flag allowlist and linker handling in the Go toolchain, .syso files, //go:cgo_* pragmas and the net/http MaxBytesReader, but no files, functions or commits.

Como foi descoberta

According to securityonline.info, the Go Security Team found most of the issues in an internal audit, and outside researchers Jakub Ciolek, Ali Sherif and RyotaK of GMO Flatt Security reported the rest. The fixes shipped on November 10, 2026 in Go 1.27.4 and 1.26.11. No exploitation in the wild has been reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 22:15.