CVE-2026-56865

Received Received - Intake

Malicious Module Content Bypass in Go Module Proxy

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56865

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious Go module proxy (GOPROXY) that could forge up to two sumdb tiles. This allowed it to bypass the GOSUMDB check, which is designed to verify module integrity against a transparency log. As a result, the proxy could serve attacker-controlled module content that appears legitimate but is not detectable through normal log evaluation.

Detection Guidance

To detect if you have been affected by this vulnerability, run the following command to clear and regenerate Go module checksums: rm -r go.sum go.work.sum vendor/ && go mod tidy. This will force Go to verify module contents against the transparency log.

Impact Analysis

If exploited, this vulnerability could lead to the execution of malicious code in your Go projects. Attackers could inject harmful modules into your local Go module cache, potentially compromising your applications or development environment without your knowledge.

Mitigation Strategies

The vulnerability has been fixed in newer versions of Go where tiles are correctly verified against their parents. Update your Go installation to the latest version to mitigate this issue.

Hi! I’m here to help you understand CVE-2026-56865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70