---
id: GO-2026-6893
title: Event type spoofing via UntrustedType in github.com/google/go-eventlog
summary: Event type spoofing via UntrustedType in github.com/google/go-eventlog
severity: none
vendor: google
product: github.com/google/go-eventlog
ecosystem: go
affected:
  - github.com/google/go-eventlog < 0.0.3-0.20261001001437-1991f15bc4b0
patched:
  - github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T23:15:15.415643261Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6893'
references:
  - url: >-
      https://github.com/google/go-eventlog/commit/1991f15bc4b01cffc4e329e9e532c1ae930ae5aa
  - url: 'https://github.com/google/go-eventlog/pull/39'
  - url: 'https://github.com/golang/vulndb/issues/6893'
  - url: >-
      https://bschaatsbergen.com/posts/attacking-rats-verifiers-through-the-tcg-event-log/
tags:
  - osv
  - go
ingestedAt: '2026-11-07T16:33:46.907Z'
---

## Overview

In github.com/google/go-eventlog/tcg, Event exposes UntrustedType, which returns the raw event type header from the TCG event log without verifying that the event data matches its digest. Callers that dispatch on Event.UntrustedType after ParseAndReplay can be tricked by a modified event type field for events whose digests are not verified against EventData.

## Affected packages

- `github.com/google/go-eventlog < 0.0.3-0.20261001001437-1991f15bc4b0`

## Remediation

Upgrade to a patched release:

- `github.com/google/go-eventlog 0.0.3-0.20261001001437-1991f15bc4b0`