CLEANSTART-2026-BH69902 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

🗓️ 09 Oct 2026 00:36:49Reported by GoogleType

osv-cleanstart🔗 osv.dev👁 4 Views

Malicious GOSUMDB in the syft package serves arbitrary module content.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Vulnerability in golang.org/x/mod bundled with IBM Fusion and IBM Fusion HCI	2 Oct 202618:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for September 2026.	12 Oct 202622:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1	6 Oct 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Golang affects IBM Robotic Process Automation for Cloud Pak	9 Oct 202613:27	–	ibm
attackerkb	CVE-2026-56864	13 Aug 202621:58	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)	31 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)	31 Aug 202600:00	–	nessus
Tenable Nessus	Golang 1.25.x < 1.25.13 / 1.26.x < 1.26.6 Multiple Vulnerabilities	14 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)	21 Aug 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21593-1)	21 Aug 202600:00	–	nessus

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BH69902.json
osv	www.osv.dev/vulnerability/CVE-2026-56864
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56864

09 Oct 2026 01:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00298

syft GOSUMDB arbitrary module content