ALPINE-CVE-2026-97038: Alpine/go vulnerability

Q: What would an attacker need to control to exploit this issue?

The attacker would need to cause a build to use a malicious package containing .syso files or cgo linker inputs. Malicious direct object or library inputs, or libraries found through -L directories, can also be relevant.

Q: Are builds on all operating systems affected in the same way?

The issue applies across platforms, but the injection mechanism differs. GNU ld linker scripts can affect builds broadly, while .drectve directives are specific to Windows and LC_LINKER_OPTION commands are specific to Darwin; LTO intermediate representations can occur in ELF, PE/COFF, or Mach-O objects.

Q: Which linker flag patterns are especially risky?

The affected handling includes -l:<filename> and -l values containing colons, equals signs, or path separators. These forms are now disallowed by the go command.

Published Nov 11, 2026

Updated

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LCLINKEROPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LCLINKEROPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.

Affected Software

1 affected componentFixes available

alpine/go<1.26.11-r0

1.26.11-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/go to a version that resolves this vulnerability.
Fixed in 1.26.11-r0

Event History

Nov 11, 2026

CVE Published

via OSV·05:19 AM

Data Sourced

via OSV·05:19 AM

DescriptionAffected Software

Frequently Asked Questions

What would an attacker need to control to exploit this issue?

The attacker would need to cause a build to use a malicious package containing .syso files or cgo linker inputs. Malicious direct object or library inputs, or libraries found through -L directories, can also be relevant.

Are builds on all operating systems affected in the same way?

The issue applies across platforms, but the injection mechanism differs. GNU ld linker scripts can affect builds broadly, while .drectve directives are specific to Windows and LC_LINKER_OPTION commands are specific to Darwin; LTO intermediate representations can occur in ELF, PE/COFF, or Mach-O objects.

Which linker flag patterns are especially risky?

The affected handling includes -l:<filename> and -l values containing colons, equals signs, or path separators. These forms are now disallowed by the go command.

What protections does the updated go command add?

It validates .syso files, direct linker inputs, and libraries in -L directories as binary objects or archives. It also rejects unallowlisted .drectve directives, LC_LINKER_OPTION load commands, and LTO IR sections.