Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-39819 · CVE overview and exploitation status

EUVD-2026-28422

GO-2026-4978

BIT-golang-2026-39819

cve-program · CVE-2026-39819

• https://go.dev/issue/78584
• https://go.dev/cl/763882
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4978

euvd · EUVD-2026-28422

• https://go.dev/issue/78584
• https://go.dev/cl/763882
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4978

nvd · CVE-2026-39819

• https://go.dev/cl/763882
• https://go.dev/issue/78584
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://pkg.go.dev/vuln/GO-2026-4978

osv · GO-2026-4978

• https://go.dev/issue/78584
• https://go.dev/cl/763882
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

No related changes are available here.