goproxy

GoProxy GoProxy is a library to create a customized HTTP/HTTPS proxy server using Go aka Golang, with several configurable settings available. The target of this project is to offer an optimized proxy server, usable with reasonable amount of traffic, yet customizable and programmable. The proxy...

CLEANSTART-2026-MP78954 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

CLEANSTART-2026-DB44167 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the minio-operator package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

CLEANSTART-2026-EM39649 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

OESA-2026-3899 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

EUVD-2026-78166

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-91143

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-91143

goproxy through version 15.3 fails to enforce HTTP basic authentication on CONNECT tunnel requests. An unauthenticated attacker on the network can issue a CONNECT request to establish a tunnel through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and ...

CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

OESA-2026-3717 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

OESA-2026-3716 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

OESA-2026-3715 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

CVE-2026-91143: Authentication Bypass Using an Alternate Path or Channel

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

goproxy v1.9.1

GoProxy GoProxy is a library to create a customized HTTP/HTTPS proxy server using Go aka Golang, with several configurable settings available. The target of this project is to offer an optimized proxy server, usable with reasonable amount of traffic, yet customizable and programmable. The proxy...

Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...

MGASA-2026-0341 Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...

BIT-GOLANG-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...