SUSE · Security update for gosec
Affects SUSESource GCVE Database
Not known to be exploited.
Data as of 31 Oct 2026, 20:20 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 14 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SUSE Product Security Team SUSE | Affected
| Fixed in– |
AI-suggested
Users should upgrade to gosec version 2.25.0 or later to benefit from the fixes and new detection rules. Since this is an update to a security scanning tool rather than a vulnerability in deployed software, applying the update ensures more accurate security analysis and reduces false positives. No other specific mitigation actions are indicated.
Description
This update for the gosec security tool addresses multiple issues including false positives in security rules, fixes for taint analysis hangs and infinite recursion, and enhancements to detection rules such as insecure HTTP cookie configuration and unsafe deserialization. The update also includes dependency bumps and improvements to the CI integration. No specific vulnerability details or exploitation methods are provided.