VDB

GO-2026-6253

GO-2026-6253 PUBLISHED

Record from OSV · Published August 25, 2026

github.com/moby/go-archive is fixed in 0.3.0 (Go Modules)

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/moby/go-archiveGo Modules0.3.0
telegraf-1.38Chainguard1.38.4-r20
podman-fips-6.1Chainguard6.1.0-r1
openbaoWolfi2.6.2-r1
buildahChainguard1.45.0-r2
telegraf-1.37Chainguard1.37.3-r24
buildkitdWolfi0.32.2-r2
skaffoldWolfi2.24.0-r4
buildkitd-fipsChainguard0.32.2-r2
buildkitdChainguard0.32.2-r2
telegraf-1.38Wolfi1.38.4-r20
falcoctlChainguard0.13.0-r24

31 more packages have a fixed version. See every fix in Lookup.

Affected products

VendorProductVersions
chainguardpodman-fips-6.10
chainguardpy3-docker*
chainguardtelegraf-1.370
wolfibuildkitd0
wolfiopenbao0
chainguardbuildkitd-fips0
chainguardfalcoctl0
chainguarddocker-cli-buildx-fips0
wolfikubescape0
chainguardpodman-fips-6.00
chainguardbuildkitd0
chainguarddocker-fips-290
chainguardskaffold-fips0
chainguardbuildah0
wolfitelegraf-1.380
wolfikaniko0
chainguardopenbao-fips0
wolfipy3-docker*
chainguardact0
chainguardbuildah-fips0

…and 25 more

Timeline

  • Aug 25, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GO-2026-6253
vulnetix vdb fixes GO-2026-6253

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6253/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›