Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-94447

Checksum database bypass for golang.org/toolchain in cmd/go

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go toolchain cmd/go

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

References