CVE-2026-97042
CVE
Medium
False Positivecmd/compile: Linker Flag Injection via cgo_import_dynamic and PE DLL Names
This advisory does not affect KrakenD
This is a build-time vulnerability in the Go toolchain (
cmd/cgo, cmd/compile and cmd/link) that requires
compiling a malicious package. KrakenD distributes pre-compiled binaries and never
invokes the Go toolchain at runtime, so the gateway is not exposed. If you compile
KrakenD Enterprise plugins, build them with the krakend/builder-ee image of version
3.0.4 or 2.13.14, which ships the fixed toolchain.Addressed through routine dependency maintenance in CE 3.0.4 and EE 3.0.4, 2.13.14.
Component
Go toolchain (cmd/cgo, cmd/compile, cmd/link)
Disclosed
Nov 12, 2026
Description
The compiler only validated the first character of library names in
//go:cgo_import_dynamic directives, and on Windows the DLL names read from PE object
files were passed to the linker without validation. A malicious package could reference
arbitrary files on disk through path traversal or inject special linker arguments at
build time. This is a build-time issue in the Go toolchain and does not affect KrakenD.