CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

🗓️ 04 Sep 2026 00:40:16Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Malicious GOSUMDB in grype-fips served arbitrary module content not in transparency log.

Reporter	Title	Published	Views	Family All 5433
OSV	MINI-WHFV-G9R3-W7VX	16 Jul 202613:28	–	osv
OSV	MINI-WHGC-QPG2-3QH7	16 Aug 202619:25	–	osv
OSV	MINI-WHMJ-3HCC-7JPF	19 Aug 202613:48	–	osv
OSV	MINI-WHQG-8M86-Q6QH	19 Aug 202613:56	–	osv
OSV	MINI-WHQR-PPMV-P469	19 Aug 202614:04	–	osv
OSV	MINI-WHQW-9H97-88RF	19 Aug 202613:47	–	osv
OSV	MINI-WHWW-GJ7R-VGC3	19 Aug 202613:47	–	osv
OSV	MINI-WHXR-96GW-C34W	2 Jul 202613:31	–	osv
OSV	MINI-WJ2W-RCH3-95V7	19 Aug 202615:33	–	osv
OSV	MINI-WJ4C-F7F6-9JRP	19 Aug 202613:47	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RD72054.json
osv	www.osv.dev/vulnerability/CVE-2026-41178
osv	www.osv.dev/vulnerability/CVE-2026-56864
osv	www.osv.dev/vulnerability/CVE-2026-56865
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41178
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56864
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56865

04 Sep 2026 04:45Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.19.8

EPSS0.00336

grype-fips GOSUMDB transparency log arbitrary content module verification supply chain