Go/github.com/elastic/package-registry CVE-2026-33467: medium 5.9, EPSS 0.14%
Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry
Action: Upgrade github.com/elastic/package-registry to 1.38.0 or later.
go get github.com/elastic/package-registry@v1.38.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.38.0 | - |
Fixed versions
| 1.38.0 |
Sources
- osv: GO-2026-5611
- nvd: CVE-2026-33467
- https://github.com/advisories/GHSA-r727-5pf6-47r2
- https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081
CVE-2026-33467 · published · modified · JSON