Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-56864

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go toolchain cmd/go

Default version status: unaffected

  • 0 to < 1.25.13affected
  • 1.26.0-0 to < 1.26.6affected
  • 1.27.0-0 to < 1.27.0-rc.3affected

golang.org/x/mod golang.org/x/mod/sumdb

Default version status: unaffected

  • 0 to < 0.40.0affected

References