CVE-2026-56864: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Other sources
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56864?
CVE-2026-56864 has a risk score of 55, indicating a medium severity vulnerability.
How do I fix CVE-2026-56864?
To mitigate CVE-2026-56864, ensure the use of trusted GOPROXY and GOSUMDB sources and review configurations to prevent reliance on unverified content.
What systems are affected by CVE-2026-56864?
CVE-2026-56864 affects applications utilizing the Go module system that rely on GOSUMDB for module content verification.
What types of attacks could CVE-2026-56864 enable?
CVE-2026-56864 could enable attackers to serve malicious module content through a compromised GOSUMDB without detection.
What precautions can developers take against CVE-2026-56864?
Developers should verify and monitor GOSUMDB and GOPROXY configurations and adopt secure coding practices to avoid potential exploitation.