GITHUB.COM/GOOGLE/GO-EVENTLOG · GO-2026-6893 · Package
FIX → 0.0.3-0.20261001001437-1991f15bc4b0
In github.com/google/go-eventlog/tcg, the UntrustedType method returns the event type from the TCG event log without checking it against the event's digest. A caller that dispatches on that type after ParseAndReplay can be misled by a modified event type field.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only Go programs that import github.com/google/go-eventlog/tcg, call ParseAndReplay, and make decisions based on Event.UntrustedType. Code that does not dispatch on that field, or that verifies event digests itself, is less exposed. Teams that do not use this package can skip it.
Not affected if does-not-import-tcg, no-untrustedtype-dispatch
Who cares attestation, go, go-eventlog, tpm
UntrustedType and ParseAndReplay from github.com/google/go-eventlog/tcg.go.mod for github.com/google/go-eventlog against the fixed version below.Upgrade to 0.0.3-0.20261001001437-1991f15bc4b0
In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0