Link following in Go programming language - CVE-2026-39822

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140622

Link following in Go programming language - CVE-2026-39822

Published: July 31, 2026


Vulnerability identifier: #VU140622
CSH Severity: Low
CVSS v4 BT: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2026-39822
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to access files outside the intended root directory.

The vulnerability exists due to improper link resolution in os.Root file-opening functions when processing a path whose final component is a symbolic link and the path ends with a trailing slash. A local user can supply a crafted path to access files outside the intended root directory.

This issue affects Unix systems.


Affected software

Go programming language
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Development Tools Module
openSUSE Leap
Anolis OS
go1.25-openssl-race
go1.25-openssl-debuginfo
go1.25-openssl
go1.25-openssl-doc
go1.25
go1.25-race
go1.25-doc
golang-shared
golang-docs
golang-bin
golang
golang-misc
golang-src
golang-tests
go1.26-openssl
go1.26-openssl-race
go1.26-openssl-doc
go1.26-race
go1.26-doc
go1.26
buildah (Red Hat package)
Red Hat Advanced Cluster Security for Kubernetes

How to mitigate CVE-2026-39822

Install security update from vendor's website.

Go programming language - addressed in versions 1.25.12, 1.26.5, 1.27.0 rc.2
go1.25-openssl-race - addressed in versions 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl-debuginfo - addressed in versions 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl - addressed in versions 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25-openssl-doc - addressed in versions 1.25.12-150000.1.27.1, 1.25.12-150600.13.21.1
go1.25 - update to 1.25.12-150000.1.44.1
go1.25-race - update to 1.25.12-150000.1.44.1
go1.25-doc - update to 1.25.12-150000.1.44.1
golang-shared - update to 1.26.5-1
golang-docs - update to 1.26.5-1
golang-bin - update to 1.26.5-1
golang - update to 1.26.5-1
golang-misc - update to 1.26.5-1
golang-src - update to 1.26.5-1
golang-tests - update to 1.26.5-1
go1.26-openssl - addressed in versions 1.26.5-150000.1.12.1, 1.26.5-150600.13.9.1
go1.26-openssl-race - addressed in versions 1.26.5-150000.1.12.1, 1.26.5-150600.13.9.1
go1.26-openssl-doc - addressed in versions 1.26.5-150000.1.12.1, 1.26.5-150600.13.9.1
go1.26-race - update to 1.26.5-150000.1.18.1
go1.26-doc - update to 1.26.5-150000.1.18.1
go1.26 - update to 1.26.5-150000.1.18.1
buildah (Red Hat package) - addressed in versions 1.43.1-4.el9_8, 1.43.1-4.el10_2
Red Hat Advanced Cluster Security for Kubernetes - update to 4.11.2

External References

Related Security Bulletins