GO-2026-6893: Event type spoofing via UntrustedType in github.com/google/go-eventlog

Q: What application behavior is exposed to this issue?

Applications are exposed if they call ParseAndReplay and then dispatch or make security-relevant decisions based on Event.UntrustedType. The risk applies where event data digests are not verified against EventData.

Q: What does an attacker need to alter to exploit the issue?

An attacker needs to modify an event's type field in the TCG event log. The raw header value can then cause callers to treat the event as a different type even when the event data does not match its digest.

Q: How can I assess whether my code is affected?

Review uses of github.com/google/go-eventlog/tcg for calls to Event.UntrustedType after ParseAndReplay. Determine whether those values control dispatch or policy decisions and whether the corresponding EventData digest is verified.

Published Nov 5, 2026

Updated

In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.

Affected Software

1 affected componentFixes available

go/github.com/google/go-eventlog<0.0.3-0.20261001001437-1991f15bc4b0

0.0.3-0.20261001001437-1991f15bc4b0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/google/go-eventlog to a version that resolves this vulnerability.
Fixed in 0.0.3-0.20261001001437-1991f15bc4b0

Event History

Nov 5, 2026

Advisory Published

via OSV·10:55 PM

Data Sourced

via OSV·10:55 PM

DescriptionAffected Software

Frequently Asked Questions

What application behavior is exposed to this issue?

Applications are exposed if they call ParseAndReplay and then dispatch or make security-relevant decisions based on Event.UntrustedType. The risk applies where event data digests are not verified against EventData.

What does an attacker need to alter to exploit the issue?

An attacker needs to modify an event's type field in the TCG event log. The raw header value can then cause callers to treat the event as a different type even when the event data does not match its digest.

How can I assess whether my code is affected?

Review uses of github.com/google/go-eventlog/tcg for calls to Event.UntrustedType after ParseAndReplay. Determine whether those values control dispatch or policy decisions and whether the corresponding EventData digest is verified.

GO-2026-6893: Event type spoofing via UntrustedType in github.com/google/go-eventlog

Affected Software

Remediation

Event History

Frequently Asked Questions

What application behavior is exposed to this issue?

What does an attacker need to alter to exploit the issue?

How can I assess whether my code is affected?

Company

Resources

Contact

Frequently Asked Questions

What application behavior is exposed to this issue?

What does an attacker need to alter to exploit the issue?

How can I assess whether my code is affected?