7.5
Élevée
CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Description
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| cmd/go 1.27 | premières → < 1.27.0-rc.3 | 1.27.0-rc.3 |
| cmd/go 1.26 | 1.26.0-0 → < 1.26.6 | 1.26.6 |
| cmd/go 1.25 | premières → < 1.25.13 | 1.25.13 |
| golang.org/x/mod/sumdb 0.40 | premières → < 0.40.0 | 0.40.0 |
Références
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de cmd/go
Les 23 CVE de cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
Élevée
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
Élevée
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
Élevée
CVE-2026-42501
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum…
7.5
Élevée