Skip to content
fr Sign in
8.8 High

CVE-2026-27140 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution…

Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Affected products and versions

Product Affected versions Fixed in
cmd/go 1.26 1.26.0-0 → < 1.26.2 1.26.2
cmd/go 1.25 earliest → < 1.25.9 1.25.9
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream AUS (v.8.4) Versions not published
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) Versions not published
Red Hat Enterprise Linux AppStream AUS (v.8.6) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.8.6) Versions not published
Show the 34 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux AppStream TUS (v.8.6) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.8.8) Versions not published
Red Hat Enterprise Linux AppStream TUS (v.8.8) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.0) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.2) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.4) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat OpenShift Container Platform 4.18 1780978272 earliest → < 1780978272 1780978272
Red Hat OpenShift Container Platform 4.19 1780044910 earliest → < 1780044910 1780044910
Red Hat Enterprise Linux 8 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift Container Platform 4.17 1782184924 earliest → < 1782184924 1782184924
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260505161557.5081 earliest → < 8040020260505161557.5081a262 8040020260505161557.5081a262
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260505161557.5081 earliest → < 8040020260505161557.5081a262 8040020260505161557.5081a262
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020260505152018.97 earliest → < 8060020260505152018.97d7f71f 8060020260505152018.97d7f71f
Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020260505152018.97 earliest → < 8060020260505152018.97d7f71f 8060020260505152018.97d7f71f
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020260505152018.97 earliest → < 8060020260505152018.97d7f71f 8060020260505152018.97d7f71f
Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260506150958.6 earliest → < 8080020260506150958.6b4b45d8 8080020260506150958.6b4b45d8
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260506150958.6 earliest → < 8080020260506150958.6b4b45d8 8080020260506150958.6b4b45d8
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat OpenShift Container Platform 4.16 1786788012 earliest → < 1786788012 1786788012
Red Hat OpenShift Container Platform 4.20 1787059394 earliest → < 1787059394 1787059394
Red Hat OpenShift Container Platform 4.2 1787059394 earliest → < 1787059394 1787059394

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cmd/go

The 23 CVEs of cmd/go →
CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a… 7.8 High CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and… 7.8 High CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to… 8.4 High CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log 7.5 High
Track this CVE