CVE-2026-97040

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.

• CWE-94

• https://go.dev/cl/862153
• https://go.dev/issue/82570
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6851

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97035When using Clang or GCC, building a malicious package that u…
• CVE-2026-97036On Darwin, building a malicious package that uses cgo could …
• CVE-2026-97037Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97038Building a malicious package containing ".syso" files or cgo…
• CVE-2026-97039Building a malicious package that uses "#cgo pkg-config:" di…
• CVE-2026-9704A flaw was found in Keycloak. An authenticated user with low…8.8
• CVE-2026-97041Building a malicious package containing "//go:cgo_*" compile…
• CVE-2026-97042Building a malicious package that uses "//go:cgo_import_dyna…
• CVE-2026-97043Building a malicious package that uses cgo could bypass "#cg…
• CVE-2026-97045In childTextNodesAreLiteral, walking up the tree previously …6.1
• CVE-2026-9705A flaw was found in Keycloak's client registration service. …6.5
• CVE-2026-97054For HTTP/1 servers, when MaxBytesReader's limit is exceeded,…