CVE-2026-27143
Public on 2026-04-08
Modified on 2026-07-21
Description
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler (cmd/compile). As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption in programs compiled with affected Go versions.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | amazon-cloudwatch-agent | 2026-06-08 | ALAS2-2026-3323 | Fixed |
| Amazon Linux 2023 | amazon-cloudwatch-agent | 2026-05-26 | ALAS2023-2026-1747 | Fixed |
| Amazon Linux 2 - Docker Extra | amazon-ecr-credential-helper | 2026-05-14 | ALAS2DOCKER-2026-113 | Fixed |
| Amazon Linux 2 - Ecs Extra | amazon-ecr-credential-helper | 2026-05-14 | ALAS2ECS-2026-111 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | amazon-ecr-credential-helper | 2026-05-14 | ALAS2NITRO-ENCLAVES-2026-099 | Fixed |
| Amazon Linux 2023 | amazon-ecr-credential-helper | 2026-05-14 | ALAS2023-2026-1645 | Fixed |
| Amazon Linux 2 - Core | amazon-ssm-agent | No Fix Planned | ||
| Amazon Linux 2023 | amazon-ssm-agent | No Fix Planned | ||
| Amazon Linux 2 - Core | cni-plugins | No Fix Planned | ||
| Amazon Linux 2023 | cni-plugins | No Fix Planned | ||
| Amazon Linux 2 - Docker Extra | containerd | 2026-04-30 | ALAS2DOCKER-2026-112 | Fixed |
| Amazon Linux 2 - Ecs Extra | containerd | 2026-05-14 | ALAS2ECS-2026-109 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | containerd | 2026-04-30 | ALAS2NITRO-ENCLAVES-2026-098 | Fixed |
| Amazon Linux 2023 | containerd | 2026-04-30 | ALAS2023-2026-1606 | Fixed |
| Amazon Linux 2023 | credentials-fetcher | 2026-04-30 | ALAS2023-2026-1598 | Fixed |
| Amazon Linux 2 - Core | cri-tools | No Fix Planned | ||
| Amazon Linux 2 - Docker Extra | docker | 2026-04-30 | ALAS2DOCKER-2026-111 | Fixed |
| Amazon Linux 2 - Ecs Extra | docker | 2026-05-14 | ALAS2ECS-2026-108 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | docker | 2026-04-30 | ALAS2NITRO-ENCLAVES-2026-097 | Fixed |
| Amazon Linux 2023 | docker | 2026-04-30 | ALAS2023-2026-1615 | Fixed |
| Amazon Linux 2 - Ecs Extra | ecs-init | 2026-05-14 | ALAS2ECS-2026-110 | Fixed |
| Amazon Linux 2023 | ecs-init | 2026-05-14 | ALAS2023-2026-1637 | Fixed |
| Amazon Linux 2023 | git-lfs | No Fix Planned | ||
| Amazon Linux 2 - Core | golang | 2026-04-30 | ALAS2-2026-3259 | Fixed |
| Amazon Linux 2023 | golang | 2026-04-30 | ALAS2023-2026-1593 | Fixed |
| Amazon Linux 2 - Core | golist | 2026-04-30 | ALAS2-2026-3260 | Fixed |
| Amazon Linux 2023 | golist | 2026-04-30 | ALAS2023-2026-1599 | Fixed |
| Amazon Linux 2023 | libcap | No Fix Planned | ||
| Amazon Linux 2 - Core | nerdctl | 2026-04-30 | ALAS2-2026-3265 | Fixed |
| Amazon Linux 2023 | nerdctl | 2026-04-30 | ALAS2023-2026-1605 | Fixed |
| Amazon Linux 2 - Docker Extra | oci-add-hooks | 2026-05-14 | ALAS2DOCKER-2026-115 | Fixed |
| Amazon Linux 2 - Ecs Extra | oci-add-hooks | 2026-05-14 | ALAS2ECS-2026-112 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | oci-add-hooks | 2026-05-14 | ALAS2NITRO-ENCLAVES-2026-101 | Fixed |
| Amazon Linux 2023 | oci-add-hooks | 2026-05-14 | ALAS2023-2026-1660 | Fixed |
| Amazon Linux 2 - Core | rclone | No Fix Planned | ||
| Amazon Linux 2 - Docker Extra | runc | 2026-05-14 | ALAS2DOCKER-2026-116 | Fixed |
| Amazon Linux 2 - Ecs Extra | runc | 2026-05-09 | ALAS2ECS-2026-114 | Fixed |
| Amazon Linux 2 - Aws-nitro-enclaves-cli Extra | runc | 2026-05-14 | ALAS2NITRO-ENCLAVES-2026-102 | Fixed |
| Amazon Linux 2023 | runc | 2026-05-14 | ALAS2023-2026-1661 | Fixed |
| Amazon Linux 2 - Docker Extra | runfinch-finch | 2026-05-14 | ALAS2DOCKER-2026-117 | Fixed |
| Amazon Linux 2023 | runfinch-finch | 2026-05-14 | ALAS2023-2026-1671 | Fixed |
| Amazon Linux 2 - Docker Extra | soci-snapshotter | 2026-05-26 | ALAS2DOCKER-2026-118 | Fixed |
| Amazon Linux 2023 | soci-snapshotter | 2026-05-15 | ALAS2023-2026-1700 | Fixed |
| Amazon Linux 2023 | yq | No Fix Planned |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | CVSSv3 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |