Missing CVE-2026-27143 <> https://pkg.go.dev/vuln/GO-2026-4868

[dor-hayun]

Hi team,

Could you please check why GO-2026-4868 (CVE-2026-27143) is missing from the "go::The Go Vulnerability Database" bucket under the stdlib package?
Thanks.

[DmitriyLewen]

Hello @dor-hayun
Thanks for your report!

This is limitation of go-vulndb.
I left a comment - golang/vulndb#4956 (comment)

[dor-hayun]

Hi, what is the limitation? i encounter many missing CVEs for Go in Trivy DB.
For example https://pkg.go.dev/vuln/GO-2026-5005

[DmitriyLewen]

Hi @dor-hayun, thanks for following up!

Your two examples are actually two different cases, worth separating:

1. golang.org/x/* modules — e.g. GO-2026-5005 / CVE-2026-39833 in golang.org/x/crypto

These are ordinary third-party Go modules and should be covered. The gap is on our sourcing side: Trivy DB takes third-party Go advisories from the GitHub Advisory Database (GHSA), but golang.org/x/* advisories are published in the Go vulnerability database (go-vulndb) first and lag in GHSA — often present only as unreviewed (which Trivy doesn't ingest), or not there yet at all.

And these aren't minor: of the currently-missing golang.org/x/{crypto,net,image} CVE-2026 advisories (25 of them), 8 are CRITICAL and 6 HIGH — including CVE-2026-46595 (CVSS 10.0) in golang.org/x/crypto.

We've opened #675 to fix this by ingesting go-vulndb for third-party modules in addition to GHSA. It covers golang.org/x/crypto, golang.org/x/net, golang.org/x/image, etc., with the full data analysis. 👍

2. CVE-2026-27143 / GO-2026-4868 — this one is different: a Go toolchain advisory, not a module

In go-vulndb this entry is filed under module toolchain, affected package cmd/compile (the Go compiler); other toolchain advisories cover cmd/go, cmd/link, etc. This is a vulnerability in the Go build tooling itself, not in code that runs inside your built binary.

We can't "just" add these to the DB:

• When Trivy scans a Go binary it only reads the Go version from the build info and records it as the stdlib package — it has no notion of a separate "toolchain" component. The version number is the same, but conceptually the stdlib (runtime library linked into your binary) and the toolchain (the tool that built it) are different things.
• More importantly, the upstream data marks these as affecting only cmd/compile, so even govulncheck reports them just for the compiler, not for programs built with an affected Go version. How toolchain advisories should be modeled so they can be matched against compiled programs is an open question on the go-vulndb side — see x/vulndb: suggestion regarding GO-2026-4868 golang/vulndb#4956. Until that's resolved upstream, there's no reliable way for Trivy (or any downstream tool) to attach these advisories to a scanned artifact.

So this one is intentionally out of scope for #675.

In the meantime, CVE-2026-27143 is fixed in Go 1.25.9 and 1.26.2, so updating your Go toolchain addresses it directly.