Bug 2515836 (CVE-2026-56864)

Summary:	CVE-2026-56864 golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alebedev, jdobes, kaycoth, mwringe, orabin
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database (GOSUMDB) can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy (GOPROXY) and GOSUMDB to deliver malicious module content to a client, which cannot be detected by examining the transparency log. This vulnerability could lead to a supply chain compromise, allowing attackers to distribute malicious code.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-13 22:25:09 UTC

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy

Comment 2 Yadnyawalk Tale 2026-09-10 07:47:16 UTC

Changed to IMPORTANT - 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N from CRITICAL - 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

CVSS Justification
===================
* S:C -> S:U
- The failure is in checksum/transparency-log verification inside the Go module client; impact is on module trust and build integrity in that same security authority, not a separate privilege boundary crossing (unlike e.g. sandbox escape).
- Supply-chain harm is captured by I:H (malicious module content accepted); S:C mainly inflates the base score without adding a distinct impact the advisory describes.

* A:H -> A:N
- The advisory describes accepting malicious module content, not denial of service, crashes or resource exhaustion.
- A malicious GOSUMDB does not need to make the service unavailable; the attack goal is integrity (and lookup metadata), not outage.
- A:H on the prior vector was a major driver of Critical (9.6) with no support in GO-2026-6180 / Go issue #80745.