{"id":"GO-2026-5298","revision":"134f8a06804d469ba952b5ed0d622434","records":[{"revision":"134f8a06804d469ba952b5ed0d622434","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5298","aliases":["CVE-2026-12681","GHSA-9r4w-jg96-92mv"],"title":"Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList() in github.com/google/go-attestation","description":"Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList() in github.com/google/go-attestation","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-08-30T02:10:50.6045986+00:00","affected":[{"ecosystem":"Go","name":"github.com/google/go-attestation","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv","https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003","https://github.com/google/go-attestation/pull/502","https://github.com/google/go-attestation/releases/tag/v0.6.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5298","license":"OSV · upstream source license applies","key":"osv:GO-2026-5298","identifiers":["GO-2026-5298","CVE-2026-12681","GHSA-9r4w-jg96-92mv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}