Skip to content
Fencer Intel
no cvss —

GO-2026-6893 json

Event type spoofing via UntrustedType in github.com/google/go-eventlog

published 4d ago modified 4d ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.

Patch / fix

  • go github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0

Is GO-2026-6893 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/google/go-eventlog
<0.0.3-0.20261001001437-1991f15bc4b0
0.0.3-0.20261001001437-1991f15bc4b0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.