PT-2026-23664 · Amazon+1 · Aws-Lambda+1

Miloslav Trmač · Published 2026-03-06 · Updated 2026-03-09 · CVE-2026-27139

Positive Technologies · (AI Summary)

CVSS v3.1

2.5

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AWS Lambda versions (affected versions not specified)

Description On Unix platforms, when listing directory contents using

File.ReadDir

or

File.Readdir

, the returned

FileInfo

could reference a file outside the root directory in which the file was opened. This allows reading metadata from arbitrary locations on the filesystem using

lstat

without permitting file reading or writing outside the root. The issue impacts stdlib in 27 Lambda base images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-27139

GO-2026-4602

OPENSUSE-SU-2026:10299-1

Affected Products

Aws-Lambda

Stdlib

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10299-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4602 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-27142 · Note
• https://suse.com/security/cve/CVE-2026-27139 · Note
• https://twitter.com/CVEnew/status/2030385144561889505 · Twitter Post
• https://go.dev/cl/749480 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://twitter.com/LambdaWatchdog/status/2030252367757606977 · Twitter Post
• https://twitter.com/golang/status/2029728083977048189 · Twitter Post
• https://suse.com/security/cve/CVE-2026-25679 · Note
• https://twitter.com/oss_security/status/2030835523946688610 · Twitter Post
• https://t.me/cveNotify/154546 · Telegram Post
• https://t.me/CVEtracker/46659 · Telegram Post
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk · Note