CVE-2026-42501

🗓️ 07 May 2026 20:16:00Reported by ubuntu.comType

ubuntucve

ubuntucve🔗 ubuntu.com👁 18 Views

Malicious proxy can bypass Go toolchain checksum validation; upgrade the base Go toolchain.

Reporter	Title	Published	Views	Family All 1162
OSV	MINI-RF6G-R8PC-J576	12 May 202603:49	–	osv
OSV	MINI-RFH3-XPFC-MGPF	11 May 202605:49	–	osv
OSV	MINI-RFH4-7PJG-X7RC	11 May 202605:49	–	osv
OSV	MINI-RG9X-79HJ-G4MJ	11 May 202614:05	–	osv
OSV	MINI-RGF8-F9C5-3Q75	10 May 202614:35	–	osv
OSV	MINI-RGH6-MH72-4PRJ	10 May 202620:03	–	osv
OSV	MINI-RGRQ-J9VM-MM2P	10 May 202620:17	–	osv
OSV	MINI-RH5V-QPGQ-MX47	10 May 202623:17	–	osv
OSV	MINI-RH8H-J98H-CQX8	10 May 202620:33	–	osv
OSV	MINI-RHC4-75C5-4668	11 May 202619:03	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	22.04	all	golang-1.23	0	golang-1.23_0_all.deb
Ubuntu	24.04	all	golang-1.23	0	golang-1.23_0_all.deb
Ubuntu	26.04	all	golang-1.23	0	golang-1.23_0_all.deb
Ubuntu	22.04	all	golang-1.24	0	golang-1.24_0_all.deb
Ubuntu	24.04	all	golang-1.24	0	golang-1.24_0_all.deb
Ubuntu	26.04	all	golang-1.24	0	golang-1.24_0_all.deb
Ubuntu	26.04	all	golang-1.25	0	golang-1.25_0_all.deb
Ubuntu	14.04	all	golang-1.10	0	golang-1.10_0_all.deb
Ubuntu	16.04	all	golang-1.10	0	golang-1.10_0_all.deb
Ubuntu	18.04	all	golang-1.10	0	golang-1.10_0_all.deb

Source	Link
cve	www.cve.org/CVERecord
go-review	www.go-review.googlesource.com/c/go/+/775321
github	www.github.com/golang/go/issues/79070
groups	www.groups.google.com/g/golang-announce/c/qcCIEXso47M
go	www.go.dev/cl/775321
go	www.go.dev/issue/79070
pkg	www.pkg.go.dev/vuln/GO-2026-4984

14 May 2026 11:34Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00231

SSVC

Go toolchain Checksum validation Module proxy Checksum database Untrusted proxy Upgrade toolchain