7.5
High
CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Description
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| cmd/go 1.27 | earliest → < 1.27.0-rc.3 | 1.27.0-rc.3 |
| cmd/go 1.26 | 1.26.0-0 → < 1.26.6 | 1.26.6 |
| cmd/go 1.25 | earliest → < 1.25.13 | 1.25.13 |
| golang.org/x/mod/sumdb 0.40 | earliest → < 0.40.0 | 0.40.0 |
References
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of cmd/go
The 23 CVEs of cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
High
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
High
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
High
CVE-2026-42501
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum…
7.5
High