{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Go toolchain cmd/go: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/go-toolchain--cmd-go/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/go-toolchain--cmd-go/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · disclosed",
   "content_text": "Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Amazon Linux 2 (golang 1.26.9-1.amzn2.0.1 and 6 more)",
   "content_text": "Fixed versions: golang 1.26.9-1.amzn2.0.1, golang-bin 1.26.9-1.amzn2.0.1, golang-docs 1.26.9-1.amzn2.0.1, golang-misc 1.26.9-1.amzn2.0.1, golang-shared 1.26.9-1.amzn2.0.1, golang-src 1.26.9-1.amzn2.0.1, golang-tests 1.26.9-1.amzn2.0.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Amazon Linux 2023 (golang 1.26.9-1.amzn2023.0.1 and 6 more)",
   "content_text": "Fixed versions: golang 1.26.9-1.amzn2023.0.1, golang-bin 1.26.9-1.amzn2023.0.1, golang-docs 1.26.9-1.amzn2023.0.1, golang-misc 1.26.9-1.amzn2023.0.1, golang-shared 1.26.9-1.amzn2023.0.1, golang-src 1.26.9-1.amzn2023.0.1, golang-tests 1.26.9-1.amzn2023.0.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Chainguard (calico-apiserver-3.30 0 and 117 more)",
   "content_text": "Fixed versions: calico-apiserver-3.30 0, calico-apiserver-3.31 0, calico-apiserver-3.32 0, calico-apiserver-fips-3.30 0, calico-apiserver-fips-3.31 0, calico-apiserver-fips-3.32 0, calico-app-policy-3.30 0, calico-app-policy-3.31 0, calico-app-policy-3.32 0, calico-app-policy-fips-3.30 0, calico-app-policy-fips-3.31 0, calico-app-policy-fips-3.32 0, calico-cni-3.30 0, calico-cni-3.31 0, calico-cni-3.32 0, calico-cni-fips-3.30 0, calico-cni-fips-3.31 0, calico-cni-fips-3.32 0, calico-felix-3.30 0, calico-felix-3.31 0, calico-felix-3.32 0, calico-felix-fips-3.30 0, calico-felix-fips-3.31 0, calico-felix-fips-3.32 0, calico-goldmane-3.30 0, calico-goldmane-3.31 0, calico-goldmane-3.32 0, calico-goldmane-fips-3.30 0, calico-goldmane-fips-3.31 0, calico-goldmane-fips-3.32 0, calico-key-cert-provisioner-3.30 0, calico-key-cert-provisioner-3.31 0, calico-key-cert-provisioner-3.32 0, calico-key-cert-provisioner-fips-3.30 0, calico-key-cert-provisioner-fips-3.31 0, calico-key-cert-provisioner-fips-3.32 0, calico-kube-controllers-3.30 0, calico-kube-controllers-3.31 0, calico-kube-controllers-3.32 0, calico-kube-controllers-fips-3.30 0, calico-kube-controllers-fips-3.31 0, calico-kube-controllers-fips-3.32 0, calico-node-3.30 0, calico-node-3.31 0, calico-node-3.32 0, calico-node-fips-3.30 0, calico-node-fips-3.31 0, calico-node-fips-3.32 0, calico-pod2daemon-3.30 0, calico-pod2daemon-3.31 0, calico-pod2daemon-3.32 0, calico-pod2daemon-fips-3.30 0, calico-pod2daemon-fips-3.31 0, calico-pod2daemon-fips-3.32 0, calico-typha-client-3.30 0, calico-typha-client-3.31 0, calico-typha-client-3.32 0, calico-typha-client-fips-3.30 0, calico-typha-client-fips-3.31 0, calico-typha-client-fips-3.32 0, calico-typhad-3.30 0, calico-typhad-3.31 0, calico-typhad-3.32 0, calico-typhad-fips-3.30 0, calico-typhad-fips-3.31 0, calico-typhad-fips-3.32 0, calico-whisker-backend-3.30 0, calico-whisker-backend-3.31 0, calico-whisker-backend-3.32 0, calico-whisker-backend-fips-3.30 0, calico-whisker-backend-fips-3.31 0, calico-whisker-backend-fips-3.32 0, calicoctl-3.30 0, calicoctl-3.31 0, calicoctl-3.32 0, calicoctl-fips-3.30 0, calicoctl-fips-3.31 0, calicoctl-fips-3.32 0, commercial-gitlab-rails-ee-fips-19.1 19.1.8-r0, commercial-nginx-ingress 5.7.0-r0, datadog-agent-7.77-fakeintake 0, datadog-agent-7.77-serverless-init 0, datadog-cluster-agent-7.77 0, gitlab-rails-ce-18.11 0, gitlab-rails-ce-18.8 0, gitlab-rails-ce-18.9 0, gitlab-rails-ce-19.0 0, gitlab-rails-ce-19.1 0, gitlab-rails-ce-fips-18.8 0, go-1.25 0, go-1.25-asm 0, go-1.25-cover 0, go-fips-1.25 0, go-fips-md5-1.25 0, go-msft-1.25 0, go-openssl-1.25 0, go-openssl-1.26 0, go-openssl-1.26 1.26.10-r0, go-openssl-1.26-doc 1.26.10-r0, go-slim-1.25 0, howdy-go 0, nemo 2.7.3-r36, nemo-gym 0.5.0_rc0_git20260729-r1, nemo-rl-cuda-13.0 0.7.0-r5, nemo-rl-cuda-13.0-automodel 0.7.0-r5, nemo-rl-cuda-13.0-mcore 0.7.0-r5, nemo-rl-cuda-13.0-mooncake 0, nemo-rl-cuda-13.0-sglang 0.7.0-r5, nemo-rl-cuda-13.0-vllm 0.7.0-r5, nvidia-nsight-compute-12.8 2025.1.1.2-r10, nvidia-nsight-compute-12.9 2025.2.1.3-r8, nvidia-nsight-compute-13.0 2025.3.1.4-r1, nvidia-nsight-compute-13.1 2025.4.1.2-r3, nvidia-nsight-compute-13.2 2026.1.1.2-r6, nvidia-nsight-compute-13.3 2026.2.1.5-r3, nvidia-nsight-compute-13.4 2026.3.1.2-r1, scanner-test-golang-vulnerability-fixed 0, scanner-test-golang-vulnerability-unfixed 0.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Debian 14 (golang-1.26 1.26.9-1 and 1 more)",
   "content_text": "Fixed versions: golang-1.26 1.26.9-1, golang-1.27 1.27.2-1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed upstream (Go)",
   "content_text": "Fixed versions: toolchain 1.26.9, toolchain 1.27.2.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in openSUSE Leap 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in openSUSE Tumbleweed (go1.26 1.26.9-1.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-1.1, go1.27 1.27.2-1.1, rclone 1.75.2-1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Red Hat hummingbird 1 (golang1.26 0:1.26.9-0.1.hum1 and 11 more)",
   "content_text": "Fixed versions: golang1.26 0:1.26.9-0.1.hum1, golang1.26-bin 0:1.26.9-0.1.hum1, golang1.26-docs 0:1.26.9-0.1.hum1, golang1.26-misc 0:1.26.9-0.1.hum1, golang1.26-src 0:1.26.9-0.1.hum1, golang1.26-tests 0:1.26.9-0.1.hum1, golang1.27 0:1.27.2-0.1.hum1, golang1.27-bin 0:1.27.2-0.1.hum1, golang1.27-docs 0:1.27.2-0.1.hum1, golang1.27-misc 0:1.27.2-0.1.hum1, golang1.27-src 0:1.27.2-0.1.hum1, golang1.27-tests 0:1.27.2-0.1.hum1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-module-for-development-tools-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Module for Development Tools 15 SP7 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94447/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94447/",
   "title": "CVE-2026-94447 · Go toolchain cmd/go · fixed in Wolfi (calico-apiserver-3.31 0 and 31 more)",
   "content_text": "Fixed versions: calico-apiserver-3.31 0, calico-apiserver-3.32 0, calico-app-policy-3.31 0, calico-app-policy-3.32 0, calico-cni-3.31 0, calico-cni-3.32 0, calico-felix-3.31 0, calico-felix-3.32 0, calico-goldmane-3.31 0, calico-goldmane-3.32 0, calico-key-cert-provisioner-3.31 0, calico-key-cert-provisioner-3.32 0, calico-kube-controllers-3.31 0, calico-kube-controllers-3.32 0, calico-node-3.31 0, calico-node-3.32 0, calico-pod2daemon-3.31 0, calico-pod2daemon-3.32 0, calico-typha-client-3.31 0, calico-typha-client-3.32 0, calico-typhad-3.31 0, calico-typhad-3.32 0, calico-whisker-backend-3.31 0, calico-whisker-backend-3.32 0, calicoctl-3.31 0, calicoctl-3.32 0, datadog-agent-7.77-fakeintake 0, datadog-cluster-agent-7.77 0, go-1.25 0, go-1.25-asm 0, go-1.25-cover 0, howdy-go 0.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · disclosed",
   "content_text": "Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Amazon Linux 2 (golang 1.26.9-1.amzn2.0.1 and 6 more)",
   "content_text": "Fixed versions: golang 1.26.9-1.amzn2.0.1, golang-bin 1.26.9-1.amzn2.0.1, golang-docs 1.26.9-1.amzn2.0.1, golang-misc 1.26.9-1.amzn2.0.1, golang-shared 1.26.9-1.amzn2.0.1, golang-src 1.26.9-1.amzn2.0.1, golang-tests 1.26.9-1.amzn2.0.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Amazon Linux 2023 (golang 1.26.9-1.amzn2023.0.1 and 6 more)",
   "content_text": "Fixed versions: golang 1.26.9-1.amzn2023.0.1, golang-bin 1.26.9-1.amzn2023.0.1, golang-docs 1.26.9-1.amzn2023.0.1, golang-misc 1.26.9-1.amzn2023.0.1, golang-shared 1.26.9-1.amzn2023.0.1, golang-src 1.26.9-1.amzn2023.0.1, golang-tests 1.26.9-1.amzn2023.0.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Chainguard (calico-apiserver-3.30 0 and 117 more)",
   "content_text": "Fixed versions: calico-apiserver-3.30 0, calico-apiserver-3.31 0, calico-apiserver-3.32 0, calico-apiserver-fips-3.30 0, calico-apiserver-fips-3.31 0, calico-apiserver-fips-3.32 0, calico-app-policy-3.30 0, calico-app-policy-3.31 0, calico-app-policy-3.32 0, calico-app-policy-fips-3.30 0, calico-app-policy-fips-3.31 0, calico-app-policy-fips-3.32 0, calico-cni-3.30 0, calico-cni-3.31 0, calico-cni-3.32 0, calico-cni-fips-3.30 0, calico-cni-fips-3.31 0, calico-cni-fips-3.32 0, calico-felix-3.30 0, calico-felix-3.31 0, calico-felix-3.32 0, calico-felix-fips-3.30 0, calico-felix-fips-3.31 0, calico-felix-fips-3.32 0, calico-goldmane-3.30 0, calico-goldmane-3.31 0, calico-goldmane-3.32 0, calico-goldmane-fips-3.30 0, calico-goldmane-fips-3.31 0, calico-goldmane-fips-3.32 0, calico-key-cert-provisioner-3.30 0, calico-key-cert-provisioner-3.31 0, calico-key-cert-provisioner-3.32 0, calico-key-cert-provisioner-fips-3.30 0, calico-key-cert-provisioner-fips-3.31 0, calico-key-cert-provisioner-fips-3.32 0, calico-kube-controllers-3.30 0, calico-kube-controllers-3.31 0, calico-kube-controllers-3.32 0, calico-kube-controllers-fips-3.30 0, calico-kube-controllers-fips-3.31 0, calico-kube-controllers-fips-3.32 0, calico-node-3.30 0, calico-node-3.31 0, calico-node-3.32 0, calico-node-fips-3.30 0, calico-node-fips-3.31 0, calico-node-fips-3.32 0, calico-pod2daemon-3.30 0, calico-pod2daemon-3.31 0, calico-pod2daemon-3.32 0, calico-pod2daemon-fips-3.30 0, calico-pod2daemon-fips-3.31 0, calico-pod2daemon-fips-3.32 0, calico-typha-client-3.30 0, calico-typha-client-3.31 0, calico-typha-client-3.32 0, calico-typha-client-fips-3.30 0, calico-typha-client-fips-3.31 0, calico-typha-client-fips-3.32 0, calico-typhad-3.30 0, calico-typhad-3.31 0, calico-typhad-3.32 0, calico-typhad-fips-3.30 0, calico-typhad-fips-3.31 0, calico-typhad-fips-3.32 0, calico-whisker-backend-3.30 0, calico-whisker-backend-3.31 0, calico-whisker-backend-3.32 0, calico-whisker-backend-fips-3.30 0, calico-whisker-backend-fips-3.31 0, calico-whisker-backend-fips-3.32 0, calicoctl-3.30 0, calicoctl-3.31 0, calicoctl-3.32 0, calicoctl-fips-3.30 0, calicoctl-fips-3.31 0, calicoctl-fips-3.32 0, commercial-gitlab-rails-ee-fips-19.1 19.1.8-r0, commercial-nginx-ingress 5.7.0-r0, datadog-agent-7.77-fakeintake 0, datadog-agent-7.77-serverless-init 0, datadog-cluster-agent-7.77 0, gitlab-rails-ce-18.11 0, gitlab-rails-ce-18.8 0, gitlab-rails-ce-18.9 0, gitlab-rails-ce-19.0 0, gitlab-rails-ce-19.1 0, gitlab-rails-ce-fips-18.8 0, go-1.25 0, go-1.25-asm 0, go-1.25-cover 0, go-fips-1.25 0, go-fips-md5-1.25 0, go-msft-1.25 0, go-openssl-1.25 0, go-openssl-1.26 0, go-openssl-1.26 1.26.10-r0, go-openssl-1.26-doc 1.26.10-r0, go-slim-1.25 0, howdy-go 0, nemo 2.7.3-r36, nemo-gym 0.5.0_rc0_git20260729-r1, nemo-rl-cuda-13.0 0.7.0-r5, nemo-rl-cuda-13.0-automodel 0.7.0-r5, nemo-rl-cuda-13.0-mcore 0.7.0-r5, nemo-rl-cuda-13.0-mooncake 0, nemo-rl-cuda-13.0-sglang 0.7.0-r5, nemo-rl-cuda-13.0-vllm 0.7.0-r5, nvidia-nsight-compute-12.8 2025.1.1.2-r10, nvidia-nsight-compute-12.9 2025.2.1.3-r8, nvidia-nsight-compute-13.0 2025.3.1.4-r1, nvidia-nsight-compute-13.1 2025.4.1.2-r3, nvidia-nsight-compute-13.2 2026.1.1.2-r6, nvidia-nsight-compute-13.3 2026.2.1.5-r3, nvidia-nsight-compute-13.4 2026.3.1.2-r1, scanner-test-golang-vulnerability-fixed 0, scanner-test-golang-vulnerability-unfixed 0.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Debian 14 (golang-1.26 1.26.9-1 and 1 more)",
   "content_text": "Fixed versions: golang-1.26 1.26.9-1, golang-1.27 1.27.2-1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed upstream (Go)",
   "content_text": "Fixed versions: toolchain 1.26.9, toolchain 1.27.2.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in openSUSE Leap 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in openSUSE Tumbleweed (go1.26 1.26.9-1.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-1.1, go1.27 1.27.2-1.1, rclone 1.75.2-1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Red Hat hummingbird 1 (golang1.26 0:1.26.9-0.1.hum1 and 11 more)",
   "content_text": "Fixed versions: golang1.26 0:1.26.9-0.1.hum1, golang1.26-bin 0:1.26.9-0.1.hum1, golang1.26-docs 0:1.26.9-0.1.hum1, golang1.26-misc 0:1.26.9-0.1.hum1, golang1.26-src 0:1.26.9-0.1.hum1, golang1.26-tests 0:1.26.9-0.1.hum1, golang1.27 0:1.27.2-0.1.hum1, golang1.27-bin 0:1.27.2-0.1.hum1, golang1.27-docs 0:1.27.2-0.1.hum1, golang1.27-misc 0:1.27.2-0.1.hum1, golang1.27-src 0:1.27.2-0.1.hum1, golang1.27-tests 0:1.27.2-0.1.hum1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-module-for-development-tools-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Module for Development Tools 15 SP7 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150000.1.21.2, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (go1.26 1.26.9-150000.1.33.1 and 2 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-150000.1.33.1, go1.26-openssl 1.26.10-150600.13.18.1, go1.27 1.27.2-150000.1.12.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (go1.26 1.26.9-160000.1.1 and 1 more)",
   "content_text": "Fixed versions: go1.26 1.26.9-160000.1.1, go1.27 1.27.2-160000.1.1.",
   "date_published": "2026-10-08T22:53:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-94444/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-94444/",
   "title": "CVE-2026-94444 · Go toolchain cmd/go · fixed in Wolfi (calico-apiserver-3.31 0 and 31 more)",
   "content_text": "Fixed versions: calico-apiserver-3.31 0, calico-apiserver-3.32 0, calico-app-policy-3.31 0, calico-app-policy-3.32 0, calico-cni-3.31 0, calico-cni-3.32 0, calico-felix-3.31 0, calico-felix-3.32 0, calico-goldmane-3.31 0, calico-goldmane-3.32 0, calico-key-cert-provisioner-3.31 0, calico-key-cert-provisioner-3.32 0, calico-kube-controllers-3.31 0, calico-kube-controllers-3.32 0, calico-node-3.31 0, calico-node-3.32 0, calico-pod2daemon-3.31 0, calico-pod2daemon-3.32 0, calico-typha-client-3.31 0, calico-typha-client-3.32 0, calico-typhad-3.31 0, calico-typhad-3.32 0, calico-whisker-backend-3.31 0, calico-whisker-backend-3.32 0, calicoctl-3.31 0, calicoctl-3.32 0, datadog-agent-7.77-fakeintake 0, datadog-cluster-agent-7.77 0, go-1.25 0, go-1.25-asm 0, go-1.25-cover 0, howdy-go 0.",
   "date_published": "2026-10-08T22:53:57Z"
  }
 ]
}