ALPINE-CVE-2026-97041: Alpine/go vulnerability
Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.11-r0
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue affects builds on ELF platforms where the Go toolchain invokes an external linker. It is triggered through malicious package source containing specific //go:cgo_* compiler directives.
What would an attacker need to control to exploit it?
An attacker would need to cause a malicious Go package to be built. The package can use commas or a leading @ character in cgo directive symbol names or dynamic linker paths to inject host linker flags or response-file arguments.
Can this be triggered from a non-cgo Go source file?
Yes. The two-argument form of //go:cgo_import_dynamic is permitted in non-cgo Go source files and could overwrite the external symbol name of a symbol already marked for cgo export.
What changes prevent exploitation in the corrected toolchain?
The corrected compiler and linker reject commas in affected //go:cgo_* symbol and dynamic-linker directives. The linker also uses -Wl,--dynamic-linker=<path> rather than the comma-separated form, and cgo_import_dynamic can no longer overwrite symbols exported through cgo_export_dynamic or cgo_export_static.