CVE-2026-27143 is a critical (CVSS 9.8) bug in the Go compiler, cmd/compile. Arithmetic over loop induction variables was not checked for underflow or overflow, so invalid indexing could occur at runtime. Rebuild with Go 1.25.9 or 1.26.2, because the fix lives in the toolchain, not in your code.
What's affected
The Go vulnerability database lists cmd/compile before go1.25.9, and from go1.26.0-0 before go1.26.2, as affected. The component is the compiler, so what matters is the Go version that built your binary.
Fixed toolchains are go1.25.9 and go1.26.2. The Go project credits Jakub Ciolek for the report.
How to check if you're exposed
Check your toolchain, and the toolchain recorded in built binaries:
go version
go version -m ./yourbinary
Any binary built with a Go version below 1.25.9, or a 1.26 version below 1.26.2, was compiled by an affected compiler. CI images, base images and developer machines can each pin a different version, so check all three.
What to do now
- Update your Go toolchain to 1.25.9 or 1.26.2 or later.
- Rebuild and redeploy every binary built with an older toolchain, since upgrading the compiler does not change binaries already built.
- Update CI images and container build stages to pin the fixed version.
- Use go version -m on shipped binaries to find ones still built with an affected release.
- Add a check to your pipeline that fails the build when the toolchain falls below your minimum.
Why it matters
The record gives no CWE for this CVE. The Go advisory describes it as missing overflow checks on arithmetic in loops, which let the compiler allow invalid indexing at runtime and so potentially memory corruption.
Compiler bugs are awkward for dependency scanning because the vulnerable code is not in your dependencies. It is in the tool that builds them. That makes an inventory of build toolchains, along with libraries, part of knowing your exposure. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to change my source code?
No. The fix is in the compiler, so rebuild with a fixed Go version.
Sources
- CVE-2026-27143 on Gold
- Go vulnerability report GO-2026-4868, fetched: https://pkg.go.dev/vuln/GO-2026-4868
- Go issue listed in the record: https://go.dev/issue/78333
Last reviewed: 19 October 2026.
