866 matches found
CVE-2026-56865
A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...
BIT-GOLANG-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
BIT-GOLANG-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...
SUSE CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
SUSE CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: commercial-grafana, opentelemetry-collector-fips, jaeger, prometheus-fips, metrics-server, ops-agent, minio-operator-fips, prometheus-pushgateway, agentbeat, cloud-sql-proxy, fluent-bit-plugin-loki, splunk-otel-collector, grafana, karma, aws-otel-collector-fips,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: k3d, grpc-health-probe, kubernetes-csi-external-provisioner, step, zarf, cert-manager-cmctl, kwok, certificate-transparency, terragrunt, terraform-provider-google, guac, terraform-docs, spicedb, cloudnative-pg, spire-server, spegel, melange, sigstore-scaffolding,...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: istio, certificate-transparency, keda, mc, telegraf, karma, minio-object-browser, cloud-sql-proxy, trillian, minio-operator, grafana-pyroscope, tempo, minio, jaeger, mcp-grafana, prometheus-pushgateway, aws-otel-collector, splunk-otel-collector, loki, datadog-agent...
GO-2026-5381 vulnerabilities
Vulnerabilities for packages: istio, amazon-cloudwatch-agent-operator, certificate-transparency, keda, node-problem-detector, mc, telegraf, karma, opentelemetry-operator, minio-object-browser, cloud-sql-proxy, fluent-bit-plugin-loki, opentelemetry-collector-contrib, k8sgpt, trillian,...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: prometheus, istio, amazon-cloudwatch-agent-operator, certificate-transparency, keda, node-problem-detector, mc, karma, cloud-sql-proxy, fluent-bit-plugin-loki, k8sgpt, trillian, minio-operator, tempo, metrics-server, prometheus-operator, minio, jaeger,...
GO-2026-4503 vulnerabilities
Vulnerabilities for packages: aactl, age, step, caddy, rekor, envoy-gateway, certificate-transparency, kine, juicefs, terragrunt, dgraph, telegraf, spicedb, chezmoi, amass, spire-server, mattermost, wolfictl, step-issuer, seaweedfs, kubeflow-pipelines, sqlexporter, croc, grafana-alloy, tailscale,...
Linux Distros Unpatched Vulnerability : CVE-2026-56865
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist...
Linux Distros Unpatched Vulnerability : CVE-2026-56864
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and...
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
DEBIAN-CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
EUVD-2026-58513
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...