Package · golang
stdlib
4 images ship it, in 5 versions. Oldest version first. Search its versions.
Not covered
2 images have no package set in the report. Whether they ship this is unknown: amazonlinux:2023, debian:trixie-slim.
go1.26.4
pkg:golang/stdlib@1.26.4
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-4970 | high | 1.25.12, 1.26.5, 1.27.0-rc.2 | 1 | 0 |
| GO-2026-5026 | high | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-5942 | high | 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-5972 | high | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6088 | high | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6089 | high | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6090 | high | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6603 | high | 1.26.9 | 1 | 0 |
| GO-2026-6605 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6607 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6608 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6609 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6610 | high | 1.26.9 | 1 | 0 |
| GO-2026-6611 | high | 1.26.9 | 1 | 0 |
| GO-2026-6613 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-5856 | medium | 1.25.12, 1.26.5, 1.27.0-rc.2 | 1 | 0 |
| GO-2026-6091 | medium | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6218 | medium | 1.25.13, 1.26.6, 1.27.0-rc.3 | 1 | 0 |
| GO-2026-6599 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6600 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6617 | unknown | 1.26.9 | 1 | 0 |
| GO-2026-6604 | critical | 1.26.9, 1.27.2 | 0 | 1 |
| GO-2026-6612 | critical | 1.26.9 | 0 | 1 |
go1.26.6
pkg:golang/stdlib@1.26.6
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-6603 | high | 1.26.9 | 1 | 0 |
| GO-2026-6605 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6607 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6608 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6609 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6610 | high | 1.26.9 | 1 | 0 |
| GO-2026-6611 | high | 1.26.9 | 1 | 0 |
| GO-2026-6613 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6599 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6600 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6617 | unknown | 1.26.9 | 1 | 0 |
| GO-2026-6604 | critical | 1.26.9, 1.27.2 | 0 | 1 |
| GO-2026-6612 | critical | 1.26.9 | 0 | 1 |
go1.26.8
pkg:golang/stdlib@1.26.8
| Image | Repository | Package list read from |
|---|---|---|
| amazonlinux-tools:latest | ghcr.io/northcutted/images/amazonlinux-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| debian-tools:latest | ghcr.io/northcutted/images/debian-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-6603 | high | 1.26.9 | 3 | 0 |
| GO-2026-6605 | high | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6607 | high | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6608 | high | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6609 | high | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6610 | high | 1.26.9 | 3 | 0 |
| GO-2026-6611 | high | 1.26.9 | 3 | 0 |
| GO-2026-6613 | high | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6599 | unknown | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6600 | unknown | 1.26.9, 1.27.2 | 3 | 0 |
| GO-2026-6617 | unknown | 1.26.9 | 3 | 0 |
| GO-2026-6604 | critical | 1.26.9, 1.27.2 | 0 | 3 |
| GO-2026-6612 | critical | 1.26.9 | 0 | 3 |
go1.27.1
pkg:golang/stdlib@1.27.1
| Image | Repository | Package list read from |
|---|---|---|
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| GO-2026-6603 | high | 1.27.2 | 1 | 0 |
| GO-2026-6605 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6607 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6608 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6609 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6610 | high | 1.27.2 | 1 | 0 |
| GO-2026-6611 | high | 1.27.2 | 1 | 0 |
| GO-2026-6613 | high | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6599 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6600 | unknown | 1.26.9, 1.27.2 | 1 | 0 |
| GO-2026-6617 | unknown | 1.27.2 | 1 | 0 |
| GO-2026-6604 | critical | 1.26.9, 1.27.2 | 0 | 1 |
| GO-2026-6612 | critical | 1.27.2 | 0 | 1 |
go1.27.2
pkg:golang/stdlib@1.27.2
| Image | Repository | Package list read from |
|---|---|---|
| hello-app:latest | ghcr.io/northcutted/images/hello-app | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| platform-tools:latest | ghcr.io/northcutted/images/platform-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
Each image's package list was read from the evidence named, for the platform images listed (its packages are their union). Verified means a trusted signer vouched for all of it; anything else means some of it wasn't verified, so the list may not be complete. Not recorded means the report doesn't say where it came from.