Description
Starting with Go 1.26, the Go toolchain changed the format used to embed GOEXPERIMENT flags in the binary's build info. Trivy fails to correctly parse the stdlib version from binaries built with Go 1.26 when GOEXPERIMENT flags are present,
producing a warning:
WARN Version matching error err="version error (v1.26.0-X:nodwarf5): malformed version: v1.26.0-X:nodwarf5"
Root Cause
In pkg/dependency/parser/golang/binary/parse.go, the code strips the GOEXPERIMENT suffix using a space as the separator:
// Ex: "go1.22.3 X:boringcrypto"
stdlibVersion, _, _ = strings.Cut(stdlibVersion, " ")
Go 1.26 changed the separator from a space to a dash (golang/go@9daaab3):
┌────────────┬───────────────────────┐
│ Go version │ info.GoVersion format │
├────────────┼───────────────────────┤
│ ≤ 1.25 │ go1.25.3 X:nodwarf5 │
├────────────┼───────────────────────┤
│ ≥ 1.26 │ go1.26.0-X:nodwarf5 │
└────────────┴───────────────────────┘
With the new format, strings.Cut(..., " ") finds no match and returns the string unchanged. After prepending v, the result is v1.26.0-X:nodwarf5, which is treated as a pre-release semver and fails downstream version validation.
This issue was previously reported for Go stdlib variants in #6698.
Expected Behavior
Trivy correctly extracts v1.26.0 as the stdlib version from binaries built with Go 1.26 + GOEXPERIMENT.
Actual Behavior
Trivy extracts v1.26.0-X:nodwarf5, fails to match it against the vulnerability DB, and logs:
WARN Version matching error err="version error (v1.26.0-X:nodwarf5): malformed version: v1.26.0-X:nodwarf5"
Proposed Fix
Strip both separators — X: (Go ≤1.25) and -X: (Go ≥1.26) — following the same approach used in the Go toolchain itself in golang/go@9daaab3:
// Strip GOEXPERIMENT suffix: "go1.25.3 X:foo" (Go <=1.25) or "go1.26.0-X:foo" (Go >=1.26)
stdlibVersion, _, _ = strings.Cut(stdlibVersion, " X:")
stdlibVersion, _, _ = strings.Cut(stdlibVersion, "-X:")
References
Description
Starting with Go 1.26, the Go toolchain changed the format used to embed GOEXPERIMENT flags in the binary's build info. Trivy fails to correctly parse the stdlib version from binaries built with Go 1.26 when GOEXPERIMENT flags are present,
producing a warning:
Root Cause
In pkg/dependency/parser/golang/binary/parse.go, the code strips the GOEXPERIMENT suffix using a space as the separator:
Go 1.26 changed the separator from a space to a dash (golang/go@9daaab3):
With the new format, strings.Cut(..., " ") finds no match and returns the string unchanged. After prepending v, the result is v1.26.0-X:nodwarf5, which is treated as a pre-release semver and fails downstream version validation.
This issue was previously reported for Go stdlib variants in #6698.
Expected Behavior
Trivy correctly extracts v1.26.0 as the stdlib version from binaries built with Go 1.26 + GOEXPERIMENT.
Actual Behavior
Trivy extracts v1.26.0-X:nodwarf5, fails to match it against the vulnerability DB, and logs:
WARN Version matching error err="version error (v1.26.0-X:nodwarf5): malformed version: v1.26.0-X:nodwarf5"
Proposed Fix
Strip both separators — X: (Go ≤1.25) and -X: (Go ≥1.26) — following the same approach used in the Go toolchain itself in golang/go@9daaab3:
References