ALPINE-CVE-2026-97043: Alpine/go vulnerability
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives. When "cmd/cgo" generates "cgogotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgoldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. "cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.11-r0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments that compile untrusted or malicious Go packages using cgo are exposed. The issue occurs during the build process, rather than requiring a built application to be deployed or running.
What does an attacker need to exploit it?
An attacker needs to provide a Go package containing cgo code with crafted quoting in //go:cgo_ldflag directives. This can bypass validation of #cgo LDFLAGS and pass disallowed linker flags or unvalidated linker search paths to the external linker.
What can happen if exploitation succeeds?
A malicious package can trigger unexpected code execution at build time through linker arguments that evade the go command's checks. Crafted flag lists can also cause the go command to panic due to an out-of-bounds slice index.
How can I reduce risk if I cannot patch immediately?
Do not build untrusted Go packages that use cgo, particularly packages obtained from untrusted sources or with unreviewed build directives. Review cgo-related linker flags and build inputs before compiling them.