Vulnerability GO-2026-6893
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:55 PM UTC
Event type spoofing via UntrustedType in github.com/google/go-eventlog
<0.0.3-0.20261001001437-1991f15bc4b0
<0.0.3-0.20261001001437-1991f15bc4b0
Summary
Event type spoofing via UntrustedType in github.com/google/go-eventlog
Details
In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:55 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC