CVE-2026-56865: Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Other sources
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
— Microsoft
The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS). The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy. WS-2026-0003 was later assigned CVE-2026-18401.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
golang.org/x/mod/sumdb/tlogto a version that resolves this vulnerability.Patch CVE-2026-18401 - Operational
To determine whether the GOPROXY issue affected the environment, run: rm -r go.sum go.work.sum vendor/ && go mod tidy
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56865?
The severity of CVE-2026-56865 is rated at 55, indicating a moderate risk level.
How do I fix CVE-2026-56865?
To fix CVE-2026-56865, update to the latest version of golang.org/x/mod/sumdb/tlog that addresses this vulnerability.
What impact does CVE-2026-56865 have on my Go applications?
CVE-2026-56865 allows a malicious GOPROXY to bypass GOSUMDB checks, potentially resulting in the injection of malicious module content into your Go module cache.
Who is affected by CVE-2026-56865?
Users of the golang.org/x/mod/sumdb/tlog package who rely on GOPROXY for module retrieval are affected by CVE-2026-56865.
Is there a workaround for CVE-2026-56865?
Currently, the recommended approach for mitigating CVE-2026-56865 is to update to the fixed version of the affected package, as no specific workaround is provided.