The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golangUpgrade golang-miscUpgrade golang-testsUpgrade golang-raceUpgrade golang-binUpgrade golang-docsUpgrade delveUpgrade go-toolsetUpgrade golang-src | Oct 11, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade rcloneUpgrade go | May 20, 2026 | May 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golang-sharedUpgrade golang-docs | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-docsUpgrade golang-sharedUpgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golang | May 28, 2026 | May 7, 2026 |
| Oracle_linux | — | Upgrade golang-miscUpgrade golang-raceUpgrade go-toolsetUpgrade golang-srcUpgrade delveUpgrade golang-binUpgrade golang-docsUpgrade golangUpgrade golang-tests | Jun 5, 2026 | May 7, 2026 |
| Redhat_linux | — | Upgrade golang-binUpgrade golang-srcUpgrade delve-debuginfoUpgrade go-toolsetUpgrade golang-docsUpgrade golangUpgrade delveUpgrade delve-debugsourceUpgrade golang-miscUpgrade golang-testsUpgrade golang-race | Aug 27, 2026 | May 7, 2026 |
| Rocky_linux | — | Upgrade golangUpgrade delve-debugsourceUpgrade golang-binUpgrade delveUpgrade golang-raceUpgrade go-toolsetUpgrade delve-debuginfo | Aug 27, 2026 | Aug 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | May 7, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub