https://seclists.org/oss-sec/2026/q2/454: Go 1.26.3 and Go 1.25.10 aleased with 11 security fixes
Published May 8, 2026
·Updated
Affected Software
1 affected component
go Go<1.26.3, <1.25.10
Frequently Asked Questions
1
What is the severity of the vulnerability in Go 1.26.3 and Go 1.25.10?
The severity of the vulnerabilities addressed in Go 1.26.3 and Go 1.25.10 is classified as high due to the potential risk of exploitation by malicious actors.
2
How do I fix the vulnerabilities in Go 1.26.3 and Go 1.25.10?
To fix the vulnerabilities, update your Go installation to version 1.26.3 or 1.25.10 as recommended by the release announcement.
3
What specific vulnerabilities are addressed in Go 1.26.3 and Go 1.25.10?
Go 1.26.3 and Go 1.25.10 address 11 security vulnerabilities, including issues with cmd/go and module proxy security.
4
What are the risks of not updating to Go 1.26.3 or Go 1.25.10?
Failing to update to Go 1.26.3 or Go 1.25.10 could expose your applications to exploitation via the vulnerabilities, compromising security.
5
How does the malicious module proxy vulnerability work in Go 1.26.3 and Go 1.25.10?
The malicious module proxy vulnerability allows attackers to bypass the checksum database, potentially serving malicious code instead of the expected modules.