Unsafe cgo compiler flags
A malicious cgo package can use compiler or linker flags such as --sysroot or -target to execute code during the build.
Go fixes build-time code execution paths and an HTTP/1 server crash
Go 1.27.4 and 1.26.11 fix 12 vulnerabilities. Malicious build inputs can trigger code execution. A separate race can crash HTTP/1 servers whose handlers use MaxBytesReader or MaxBytesHandler and concurrently read the body and write response headers.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Sharted
- 12 CVEs tracked here
- Splash zone
- Builds of untrusted Go packages and HTTP/1 handlers with concurrent body reads and header writes using Go’s body limit helpers
- go
- In the wild
- Unknown
- The Go release and vulnerability records do not report exploitation.
What happened
Go released 1.27.4 and 1.26.11 on November 10. Eleven fixes address build inputs such as cgo directives, native objects and compiler or linker arguments. Several flaws can execute code as the build user when it builds a malicious package. The path depends on the input and toolchain. Examples include GCC spec files, Apple linker plugins and crafted .syso objects. Review CI jobs that compile untrusted contributions or newly introduced dependencies and can access credentials or publishing permissions.
The separate net/http flaw affects HTTP/1 handlers using MaxBytesReader or MaxBytesHandler. When the request body exceeds the limit, reading it concurrently with writing response headers can cause a panic that crashes the server. Upgrade the toolchain used to produce deployed binaries and rebuild affected services. Updating the build machine alone leaves existing binaries unchanged.
What’s in the bowl
Untrusted GCC spec files
With GCC, a malicious cgo package can make certain linker options load a package-controlled specs file and execute commands.
Clang and GCC flag bypass
A malicious cgo package can abuse Clang -gen-* or GCC -gnat* flags to execute code or write files to arbitrary directories.
Apple linker plugin loading
On Darwin, a malicious cgo package can make the Apple linker combine -l and to_library to load a package-chosen plugin.
cgo linker script injection
Split -Wl, arguments and certain options accepted by GNU ld.bfd can let a malicious cgo package supply linker scripts that execute code.
Malicious linker input files
Crafted .syso files or cgo linker inputs can inject flags or execute code at link time.
pkg-config flag bypass
A malicious package using #cgo pkg-config: directives can load untrusted .pc files or pass unchecked compiler and linker flags.
Go object disguised as .syso
A package can disguise a Go object as a .syso file to inject cgo linker directives.
ELF linker flag injection
Crafted //go:cgo_* directives in a malicious package can inject arbitrary flags into the external linker on ELF platforms.
Unsafe dynamic imports
A malicious package can pass unsafe library arguments through //go:cgo_import_dynamic or through a crafted PE object on Windows.
Escaped quotes bypass cgo checks
A malicious cgo package can use escaped quotes in //go:cgo_ldflag to execute code during the build or cause the go command to panic.
HTTP/1 response header race
An HTTP/1 server using MaxBytesReader or MaxBytesHandler may crash when the body exceeds the limit and the handler reads it concurrently with writing response headers.
Are you standing in it?
Run go version on each box, then type the version or pick the closest match.
| Branch | Safe from | Status |
|---|---|---|
| Go 1.27 | 1.27.4 | Supported |
| Go 1.26 | 1.26.11 | Supported |
| Older Go releases | none | Upgrade to a supported branch |
Crime-scene timeline
Nov 10, 17:14 UTC
Go publishes 1.27.4 and 1.26.11
The announcement details 11 toolchain fixes and one net/http fix.
Nov 11, 02:51 UTC
Go publishes the vulnerability records
The 12 records give affected ranges and the two fixed versions.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Go release historyPrimaryConfirms both releases and the support policy.
- Go security announcementPrimaryOriginal Go team announcement explaining the prerequisites and impact for all 12 fixes.
- Go vulnerability database GO-2026-6848PrimaryOfficial details and version ranges for CVE-2026-97043.
- Go vulnerability database GO-2026-6849PrimaryOfficial details and version ranges for CVE-2026-97042.
- Go vulnerability database GO-2026-6850PrimaryOfficial details and version ranges for CVE-2026-97041.
- Go vulnerability database GO-2026-6851PrimaryOfficial details and version ranges for CVE-2026-97040.
- Go vulnerability database GO-2026-6852PrimaryOfficial details and version ranges for CVE-2026-97039.
- Go vulnerability database GO-2026-6853PrimaryOfficial details and version ranges for CVE-2026-97038.
- Go vulnerability database GO-2026-6854PrimaryOfficial details and version ranges for CVE-2026-97037.
- Go vulnerability database GO-2026-6855PrimaryOfficial details and version ranges for CVE-2026-97036.
- Go vulnerability database GO-2026-6856PrimaryOfficial details and version ranges for CVE-2026-97035.
- Go vulnerability database GO-2026-6857PrimaryOfficial details and version ranges for CVE-2026-97034.
- Go vulnerability database GO-2026-6858PrimaryOfficial details and version ranges for CVE-2026-97033.
- Go vulnerability database GO-2026-6859PrimaryOfficial details and version ranges for CVE-2026-97054.