Log in Start free

Vulnerability · Published May 7, 2026 · Assigned by Go

CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

Medium 5.3

In plain English

A medium-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:22112
AlmaLinux:8go-toolset1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9go-toolset1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-bin1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-bin1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-docs1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-docs1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-misc1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-misc1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-race1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-race1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-src1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-src1.26.3-1.el9_8ALSA-2026:22121
AlmaLinux:8golang-tests1.25.10-1.module_el8.10.0+4187+c45165c4ALSA-2026:22112
AlmaLinux:9golang-tests1.26.3-1.el9_8ALSA-2026:22121
Alpine:v3.23go1.25.10-r0ALPINE-CVE-2026-39819
Alpine:v3.24go1.26.3-r0ALPINE-CVE-2026-39819
Alpine:v3.24rclone1.74.1-r0ALPINE-CVE-2026-39819
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-39819
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-39819
Debian:14golang-1.261.26.3-1DEBIAN-CVE-2026-39819
Gotoolchain1.25.10, 1.26.3GO-2026-4978
Rocky Linux:8delve0:1.25.2-1.module+el8.10.0+40035+ee0a7047RLSA-2026:22112
Rocky Linux:10golang0:1.26.3-4.el10_2RLSA-2026:22120
Rocky Linux:8golang0:1.25.10-1.module+el8.10.0+40200+0fd0f175RLSA-2026:22112
Rocky Linux:9golang0:1.26.3-1.el9_8RLSA-2026:22121
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-39819
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-39819
Ubuntu:24.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-39819
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-39819
Ubuntu:25.10golang-1.23no fix listedUBUNTU-CVE-2026-39819
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-39819
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-39819
Ubuntu:25.10golang-1.24no fix listedUBUNTU-CVE-2026-39819
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-39819
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-39819
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-39819
Ubuntu:25.10golang-1.25no fix listedUBUNTU-CVE-2026-39819
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-39819

Affected products (as reported)

VendorProductVersions
Go toolchain cmd/go 0 – before 1.25.101.26.0-0 – before 1.26.3

References