CVE-2026-27140

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

History

25 Jul 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) Nombres de archivo SWIG que contienen 'cgo' y cargas útiles bien elaboradas podrían conducir a contrabando de código y ejecución de código arbitrario en tiempo de compilación debido a la omisión de la capa de confianza.

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34099 -

30 Jun 2026, 03:17

Type Values Removed Values Added
CWE CWE-641
References
  • () https://access.redhat.com/errata/RHSA-2026:10217 -
  • () https://access.redhat.com/errata/RHSA-2026:10219 -
  • () https://access.redhat.com/errata/RHSA-2026:10704 -
  • () https://access.redhat.com/errata/RHSA-2026:16021 -
  • () https://access.redhat.com/errata/RHSA-2026:16024 -
  • () https://access.redhat.com/errata/RHSA-2026:16494 -
  • () https://access.redhat.com/errata/RHSA-2026:16497 -
  • () https://access.redhat.com/errata/RHSA-2026:16498 -
  • () https://access.redhat.com/errata/RHSA-2026:16694 -
  • () https://access.redhat.com/errata/RHSA-2026:16697 -
  • () https://access.redhat.com/errata/RHSA-2026:16698 -
  • () https://access.redhat.com/errata/RHSA-2026:23246 -
  • () https://access.redhat.com/errata/RHSA-2026:25182 -
  • () https://access.redhat.com/security/cve/CVE-2026-27140 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2456341 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.json -

17 Jun 2026, 10:26

Type Values Removed Values Added
References () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Release Notes, Mailing List () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Mailing List, Release Notes

16 Apr 2026, 19:26

Type Values Removed Values Added
CWE CWE-863
References () https://go.dev/cl/763768 - () https://go.dev/cl/763768 - Release Notes
References () https://go.dev/issue/78335 - () https://go.dev/issue/78335 - Issue Tracking
References () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - () https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU - Release Notes, Mailing List
References () https://pkg.go.dev/vuln/GO-2026-4871 - () https://pkg.go.dev/vuln/GO-2026-4871 - Vendor Advisory
First Time Golang go
Golang
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

13 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8

08 Apr 2026, 02:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-04-08 02:16

Updated : 2026-07-25 11:10


NVD link : CVE-2026-27140

Mitre link : CVE-2026-27140

CVE.ORG link : CVE-2026-27140


JSON object : View

Products Affected

golang

  • go
CWE
CWE-863

Incorrect Authorization

CWE-641

Improper Restriction of Names for Files and Other Resources