GHSA-xhgw-qwwf-pg32

Source

https://github.com/advisories/GHSA-xhgw-qwwf-pg32

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xhgw-qwwf-pg32/GHSA-xhgw-qwwf-pg32.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xhgw-qwwf-pg32

Aliases

Downstream

CGA (605)

ECHO (1)

ECHO-f040-5fb5-1b4a

MINI (97)

Published

2026-06-03T15:30:40Z

Modified

2026-08-18T17:25:45Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

Details

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Database specific

{
    "cwe_ids":  [
        "CWE-190"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-17T13:36:32Z",
    "nvd_published_at":  "2026-06-03T13:16:19Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/cilium/ebpf

Package

Name: github.com/cilium/ebpf; View open source insights on deps.dev
Purl: pkg:golang/github.com/cilium/ebpf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.22.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xhgw-qwwf-pg32/GHSA-xhgw-qwwf-pg32.json"