# CVE-2026-39817: Invoking "go tool pack" does not sanitize output paths in cmd/go

CVE-2026-39817 is fixed in 15 products on 2 platforms, first by Go Programming Language 1.26.3, released May 7, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-39817
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 7, 2026
- Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-39817

## Description

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Go Programming Language | 1.26.3 | [Go Programming Language 1.26.3](https://patchblox.com/security/data/fix/windows-app/golang.go-1.26.3.md) | May 7, 2026 |
| Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | delve ol 8 | 0:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | delve rocky 8 | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | [RLSA-2026:22112](https://patchblox.com/security/data/fix/linux/rlsa-2026-22112.md) | Aug 26, 2026 |
| Linux | go-toolset RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | go-toolset RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | go-toolset almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | go-toolset almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | go-toolset ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | go-toolset ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | go-toolset ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.12-160000.1.1 | [OPENSUSE-SU-2026:21319-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21319-1.md) | Jul 13, 2026 |
| Linux | go1.25-openssl sles 16.0 | 1.25.12-160000.1.1 | [SUSE-SU-2026:22638-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22638-1.md) | Jul 13, 2026 |
| Linux | go1.26-openssl opensuse-leap 16.0 | 1.26.4-160000.1.1 | [OPENSUSE-SU-2026:21254-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21254-1.md) | Jul 7, 2026 |
| Linux | go1.26-openssl sles 16.0 | 1.26.4-160000.1.1 | [SUSE-SU-2026:22572-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22572-1.md) | Jul 7, 2026 |
| Linux | golang RHEL 10 | 1.26.5-1.el10_0 | [RHSA-2026:49702](https://patchblox.com/security/data/fix/linux/rhsa-2026-49702.md) | May 27, 2026 |
| Linux | golang RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang rocky 10 | 0:1.26.3-4.el10_2 | [RLSA-2026:22120](https://patchblox.com/security/data/fix/linux/rlsa-2026-22120.md) | Aug 26, 2026 |
| Linux | golang rocky 8 | 0:1.25.10-1.module+el8.10.0+40200+0fd0f175 | [RLSA-2026:22112](https://patchblox.com/security/data/fix/linux/rlsa-2026-22112.md) | Aug 26, 2026 |
| Linux | golang rocky 9 | 0:1.26.3-1.el9_8 | [RLSA-2026:22121](https://patchblox.com/security/data/fix/linux/rlsa-2026-22121.md) | Aug 26, 2026 |
| Linux | golang-1.26 Debian 14 | 1.26.3-1 | [DEBIAN-CVE-2026-39817](https://patchblox.com/security/data/fix/linux/debian-cve-2026-39817.md) | May 27, 2026 |
| Linux | golang-bin RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-bin RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-bin almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-bin almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-bin amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-bin ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-bin ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-bin ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-docs RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-docs RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-docs almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-docs almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-docs amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-docs ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-docs ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-docs ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-misc RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-misc RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-misc almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-misc almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-misc amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-misc ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-misc ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-misc ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-race RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-race RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-race almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-race almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-race ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-race ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-race ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-shared amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-src RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-src RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-src almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-src almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-src amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-src ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-src ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-src ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | golang-tests RHEL 8 | 0:1.25.10-1.module+el8.10.0+24308+5c4a16b7 | [RHSA-2026:22112](https://patchblox.com/security/data/fix/linux/rhsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-tests RHEL 9 | 0:1.26.3-1.el9_8 | [RHSA-2026:22121](https://patchblox.com/security/data/fix/linux/rhsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-tests almalinux 8 | 1.25.10-1.module_el8.10.0+4187+c45165c4 | [ALSA-2026:22112](https://patchblox.com/security/data/fix/linux/alsa-2026-22112.md) | Jun 1, 2026 |
| Linux | golang-tests almalinux 9 | 1.26.3-1.el9_8 | [ALSA-2026:22121](https://patchblox.com/security/data/fix/linux/alsa-2026-22121.md) | Jun 1, 2026 |
| Linux | golang-tests amzn 2023 | 1.25.10-1.amzn2023.0.1 | [ALAS2023-2026-1743](https://patchblox.com/security/data/fix/linux/alas2023-2026-1743.md) | May 25, 2026 |
| Linux | golang-tests ol 10 | 0:1.26.5-1.0.1.el10_2 | [ELSA-2026-22120](https://patchblox.com/security/data/fix/linux/elsa-2026-22120.md) | Jul 21, 2026 |
| Linux | golang-tests ol 8 | 0:1.25.9-1.0.1.module+el8.10.0+90898+1e3c34bb | [ELSA-2026-22112](https://patchblox.com/security/data/fix/linux/elsa-2026-22112.md) | Jun 2, 2026 |
| Linux | golang-tests ol 9 | 0:1.26.3-1.0.1.el9_8 | [ELSA-2026-22121](https://patchblox.com/security/data/fix/linux/elsa-2026-22121.md) | Jun 23, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.