Vulnpedia
← Search CVEs

CVE-2026-94447

HIGH 7.8

Published 2026-10-08 · Last modified 2026-10-15

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.1%chance of exploitation in 30 days · 1st percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.8CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: A user must take an action (click / open a file)
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Go Toolchain

Products Cmd/Go

Weakness (CWE)

  • CWE-354: Improper Validation of Integrity Check Value

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • toolchain Go

    pkg:golang/toolchain

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.26.9
    • Introduced version (included): 1.27.0-0
    • Fixed boundary (excluded): 1.27.2
    Additional upstream package constraints
    {
  "ecosystem": {
    "imports": [
      {
        "path": "cmd/go"
      }
    ]
  },
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6602.json"
  }
}
    Go Vulnerability Database · GO-2026-6602 · Updated 2026-10-16T09:55:44.518918993Z

Vendor product assessments

Showing 32 of 259 vendor product statements; 227 omitted. Read the full vendor advisory.

  • go-toolset-0:1.26.10-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-bin-0:1.26.10-1.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_0?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • go-toolset-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-docs-0:1.26.10-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • delve-0:1.26.1-1.module+el8.10.0+24516+40554724.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24516%2B40554724?arch=x86_64&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B25107%2B6b50279c?arch=ppc64le&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B25107%2B6b50279c?arch=ppc64le&rpmmod=go-toolset:rhel8:8100020261020054335:a3795dee

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.6.0%2B25114%2B90ecdb41?arch=x86_64&rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-4.module+el8.6.0+25114+90ecdb41.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.6.0%2B25114%2B90ecdb41?arch=src&rpmmod=go-toolset:rhel8:8060020261020153812:97d7f71f

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • delve-debuginfo-0:1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.8.0%2B24781%2B86ad105d?arch=ppc64le&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-docs-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.8.0%2B25113%2Ba148ecc0?arch=noarch&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-4.module+el8.8.0+25113+a148ecc0.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.8.0%2B25113%2Ba148ecc0?arch=src&rpmmod=go-toolset:rhel8:8080020261020152326:6b4b45d8

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-race-0:1.26.10-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-race-0:1.26.10-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-0:1.26.10-1.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-race-0:1.26.10-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-bin-0:1.26.10-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang-tests-0:1.26.10-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang1.26-misc-0:1.26.9-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang1.27-docs-0:1.27.2-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang1.27-tests-0:1.27.2-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/vulnerability-analysis-rhel9@sha256:9e846f56a5aeee9b65fbfee6dd2825113db854aef8dd0d5806df93fdcf2622e7?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • mta/mta-go-external-provider-rhel9 as a component of Migration Toolkit for Applications 8 · known affected

    Vendor assessment for this product only.

    pkg:oci/mta-go-external-provider-rhel9@sha256:d6133e30119f504c5dd33ef1c30b7764143264aca5487267594bc64f3342e583?repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • ubi10/go-toolset as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:oci/go-toolset@sha256:e7e1209b99b87956d6f85b0e115c0711af3515741acaa3c0a781233f8e5b0b02?repository_url=registry.redhat.io/ubi10/go-toolset

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • ubi8/go-toolset as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:oci/go-toolset@sha256:c9616928bdf5591a758f588adac9bc0212a0a4ec929222a0f1629ec90c29aa41?repository_url=registry.redhat.io/ubi8/go-toolset

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • ubi9/go-toolset as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:oci/go-toolset@sha256:8a523f9109ce1b18d2d83be3da4aa5d86191fc7b03a93605687117bf1a90d0db?repository_url=registry.redhat.io/ubi9/go-toolset

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • golang1.25.src as a component of Red Hat Hardened Images · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • openshift4/ose-operator-sdk-rhel8 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-operator-sdk-rhel8@sha256:ef37a93fde22dc5946419ac5c8da0477ba54f33200fd094731d6df326f33c5a0?repository_url=registry.redhat.io/openshift4/ose-operator-sdk-rhel8

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • openshift4/ose-operator-sdk-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-operator-sdk-rhel9@sha256:0aeb418a8af84652e1e719927938404250f8c9d68ad82ba275173a3d02d536d3?repository_url=registry.redhat.io/openshift4/ose-operator-sdk-rhel9

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00
  • devspaces/udi-rhel9 as a component of Red Hat OpenShift Dev Spaces · known affected

    Vendor assessment for this product only.

    pkg:oci/udi-rhel9@sha256:d6242483b89e7711cd5f16ba83e6c4817f42b519136db7c94e673b16e9927f1e?repository_url=registry.redhat.io/devspaces/udi-rhel9

    • workaround: Do not point GOPROXY or related module proxy settings at untrusted proxies, and do not build untrusted Go projects while using a non-default proxy. Prefer the default Go module proxy and checksum database. Setting GOTOOLCHAIN=local also avoids downloading toolchains.
    • none available: Fix deferred
    Red Hat · CVE-2026-94447 · Updated 2026-10-23T19:32:56+00:00

All CVSS metrics

  • HIGH 7.8 v3.1 · ADP Primary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • HIGH 7.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS