CVE-2026-39819

Published: May 13, 2026Last modified: May 15, 2026

Description

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

Severity score breakdown

Parameter	Value
Base score	5.3
Attack Vector	LOCAL
Attack complexity	HIGH
Privileges required	LOW
User interaction	NONE
Scope	UNCHANGED
Confidentiality	LOW
Integrity impact	HIGH
Availability impact	NONE
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Status

Product	Release	Package	Status
Alpaquita Linux	25 LTS	go	Fixed (1.25.10-r0)
Alpaquita Linux	Stream	go	Fixed (1.26.3-r0)
Hardened Containers	25 LTS	go	Fixed (1.25.10-r0)
Hardened Containers	Stream	go	Fixed (1.26.3-r0)

References

How to Fix Liberica NIK Not Starting on macOS Catalina and Later

If you use macOS Catalina and later you may encounter the issue that prevents Liberica NIK from starting. To fix it, run the following:

sudo xattr -r -d com.apple.quarantine path/to/graalvm/folder/

If you need more help, check out the FAQ at the bottom of this page or contact us.