CVE-2026-56865

The CVE-2026-56865 issue affects the Go module sumdb/tlog mechanism, where a malicious GOPROXY could forge up to two sumdb tiles, bypass the GOSUMDB check, and persist attacker-controlled module content to a local Go module cache. The consequence is the risk of serving malicious module content th...

CVE-2026-56864

The CVE describes a vulnerability in the golang.org/x/mod/sumdb ecosystem where a malicious GOSUMDB can serve arbitrary module content not contained in the transparency log, enabling a coordinated GOPROXY and GOSUMDB to deliver malicious module content that cannot be detected by evaluating the tr...

GO-2026-6179 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

GO-2026-6180 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...