# toolchain (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/toolchain Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/toolchain.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in toolchain (Go): 11 in the last 7 days and 13 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97043, was published on 11 November 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. ## Counts - Last 7 days: 11 - Last 30 days: 11 - Last 90 days: 13 - All time: 45 (1 critical, 0 exploited in the wild) ## About toolchain (Go) Go toolchain is the set of build tools and compiler for developing and compiling Go applications. ## Latest toolchain (Go) vulnerabilities - [CVE-2026-97043: Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo) (info, published 11 Nov 2026) - [CVE-2026-97042: Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or) (info, published 11 Nov 2026) - [CVE-2026-97041: Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler) (info, published 11 Nov 2026) - [CVE-2026-97040: Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass) (info, published 11 Nov 2026) - [CVE-2026-97039: Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives) (info, published 11 Nov 2026) - [CVE-2026-97038: Go linker code injection via malicious package compilation](https://junglewise.ai/threats/cve-2026-97038-building-a-malicious-package-containing-syso-files-or-cgo-linker) (info, published 11 Nov 2026) - [CVE-2026-97037: Go arbitrary code execution via malicious cgo linker flags](https://junglewise.ai/threats/cve-2026-97037-building-a-malicious-package-that-uses-cgo-could-cause-arbitrary) (info, published 11 Nov 2026) - [CVE-2026-97036: Go cgo arbitrary code execution via Apple linker argument injection](https://junglewise.ai/threats/cve-2026-97036-on-darwin-building-a-malicious-package-that-uses-cgo-could-cause) (info, published 11 Nov 2026) - [CVE-2026-97035: Go cgo arbitrary code execution via compiler flags](https://junglewise.ai/threats/cve-2026-97035-when-using-clang-or-gcc-building-a-malicious-package-that-uses) (info, published 11 Nov 2026) - [CVE-2026-97034: Go compiler arbitrary command execution via untrusted GCC spec files](https://junglewise.ai/threats/cve-2026-97034-when-using-gcc-building-a-malicious-package-that-uses-cgo-could) (info, published 11 Nov 2026) - [CVE-2026-97033: Go cgo arbitrary code execution via compiler flags](https://junglewise.ai/threats/cve-2026-97033-building-a-malicious-package-that-uses-cgo-could-cause-arbitrary) (info, published 11 Nov 2026) - [CVE-2026-94447: Go toolchain checksum database bypass in cmd/go](https://junglewise.ai/threats/cve-2026-94447-go-2026-6602-checksum-database-bypass-for-golang-org-toolchain-in) (high, CVSS 7.8, published 8 Oct 2026) - [CVE-2026-94444: Go toolchain checksum bypass in cmd/go](https://junglewise.ai/threats/cve-2026-94444-go-2026-6601-checksum-bypass-for-golang-org-fips140-in-cmd-go) (high, CVSS 7.8, published 8 Oct 2026) - [CVE-2026-56865: Go malicious GOPROXY sumdb tile forgery bypass](https://junglewise.ai/threats/cve-2026-56865-go-malicious-goproxy-sumdb-tile-forgery-bypass) (high, CVSS 8.4, published 13 Aug 2026) - [CVE-2026-56864: Go GOSUMDB malicious module content bypass](https://junglewise.ai/threats/cve-2026-56864-go-gosumdb-malicious-module-content-bypass) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-42501: Google Go checksum validation bypass in cmd/go](https://junglewise.ai/threats/cve-2026-42501-google-go-checksum-validation-bypass-in-cmd-go) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-39819: Google Go symlink attack in go bug command](https://junglewise.ai/threats/cve-2026-39819-google-go-symlink-attack-in-go-bug-command) (medium, CVSS 5.3, published 7 May 2026) - [CVE-2026-39817: Google Go arbitrary file write in go tool pack](https://junglewise.ai/threats/cve-2026-39817-google-go-arbitrary-file-write-in-go-tool-pack) (medium, CVSS 5.9, published 7 May 2026) - [CVE-2026-27144: Google Go toolchain memory corruption in cmd/compile](https://junglewise.ai/threats/cve-2026-27144-google-go-toolchain-memory-corruption-in-cmd-compile) (high, CVSS 7.1, published 8 Apr 2026) - [CVE-2026-27143: Go toolchain memory corruption in cmd/compile loop induction](https://junglewise.ai/threats/cve-2026-27143-go-toolchain-memory-corruption-in-cmd-compile-loop-induction) (critical, CVSS 9.8, published 8 Apr 2026) - [CVE-2026-27140: Google Go arbitrary code execution via malicious SWIG file names](https://junglewise.ai/threats/cve-2026-27140-google-go-arbitrary-code-execution-via-malicious-swig-file-names) (high, CVSS 8.8, published 8 Apr 2026) - [CVE-2025-61732: Google Go code smuggling in cgo via comment parsing discrepancy](https://junglewise.ai/threats/cve-2025-61732-google-go-code-smuggling-in-cgo-via-comment-parsing-discrepancy) (high, CVSS 8.6, published 5 Feb 2026) - [CVE-2025-61731: Google Go argument injection in cmd/go cgo directive](https://junglewise.ai/threats/cve-2025-61731-google-go-argument-injection-in-cmd-go-cgo-directive) (high, CVSS 7.8, published 28 Jan 2026) - [CVE-2025-68119: GO-2026-4338 - Unexpected code execution when invoking toolchain in cmd/go](https://junglewise.ai/threats/cve-2025-68119-go-2026-4338-unexpected-code-execution-when-invoking-toolchain-in) (info, published 28 Jan 2026) - [CVE-2025-4674: GO-2025-3828 - Unexpected command execution in untrusted VCS repositories in cmd/go](https://junglewise.ai/threats/cve-2025-4674-go-2025-3828-unexpected-command-execution-in-untrusted-vcs) (info, published 29 Jul 2025) ## Most severe toolchain (Go) vulnerabilities - [CVE-2026-27143: Go toolchain memory corruption in cmd/compile loop induction](https://junglewise.ai/threats/cve-2026-27143-go-toolchain-memory-corruption-in-cmd-compile-loop-induction) (critical, CVSS 9.8, published 8 Apr 2026) - [CVE-2026-27140: Google Go arbitrary code execution via malicious SWIG file names](https://junglewise.ai/threats/cve-2026-27140-google-go-arbitrary-code-execution-via-malicious-swig-file-names) (high, CVSS 8.8, published 8 Apr 2026) - [CVE-2025-61732: Google Go code smuggling in cgo via comment parsing discrepancy](https://junglewise.ai/threats/cve-2025-61732-google-go-code-smuggling-in-cgo-via-comment-parsing-discrepancy) (high, CVSS 8.6, published 5 Feb 2026) - [CVE-2026-56865: Go malicious GOPROXY sumdb tile forgery bypass](https://junglewise.ai/threats/cve-2026-56865-go-malicious-goproxy-sumdb-tile-forgery-bypass) (high, CVSS 8.4, published 13 Aug 2026) - [CVE-2025-61731: Google Go argument injection in cmd/go cgo directive](https://junglewise.ai/threats/cve-2025-61731-google-go-argument-injection-in-cmd-go-cgo-directive) (high, CVSS 7.8, published 28 Jan 2026) - [CVE-2026-94447: Go toolchain checksum database bypass in cmd/go](https://junglewise.ai/threats/cve-2026-94447-go-2026-6602-checksum-database-bypass-for-golang-org-toolchain-in) (high, CVSS 7.8, published 8 Oct 2026) - [CVE-2026-94444: Go toolchain checksum bypass in cmd/go](https://junglewise.ai/threats/cve-2026-94444-go-2026-6601-checksum-bypass-for-golang-org-fips140-in-cmd-go) (high, CVSS 7.8, published 8 Oct 2026) - [CVE-2026-56864: Go GOSUMDB malicious module content bypass](https://junglewise.ai/threats/cve-2026-56864-go-gosumdb-malicious-module-content-bypass) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-42501: Google Go checksum validation bypass in cmd/go](https://junglewise.ai/threats/cve-2026-42501-google-go-checksum-validation-bypass-in-cmd-go) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-27144: Google Go toolchain memory corruption in cmd/compile](https://junglewise.ai/threats/cve-2026-27144-google-go-toolchain-memory-corruption-in-cmd-compile) (high, CVSS 7.1, published 8 Apr 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 11 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "toolchain (Go) vulnerabilities", https://junglewise.ai/threats/technologies/toolchain, 13 November 2026.