CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...