CVE-2026-56864

The CVE describes a vulnerability in the golang.org/x/mod/sumdb ecosystem where a malicious GOSUMDB can serve arbitrary module content not contained in the transparency log, enabling a coordinated GOPROXY and GOSUMDB to deliver malicious module content that cannot be detected by evaluating the tr...

CVE-2026-56865

The CVE-2026-56865 issue affects the Go module sumdb/tlog mechanism, where a malicious GOPROXY could forge up to two sumdb tiles, bypass the GOSUMDB check, and persist attacker-controlled module content to a local Go module cache. The consequence is the risk of serving malicious module content th...

ROS-20260622-73-0031

The vulnerability of GOMODPROXY and GOSUMDB modules written in the Go programming language is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain access to read and modify data...