Bug 2521733

Summary: CVE-2026-56865 gcc-epel: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Thibault Guittet <tguittet>
Component: gcc-epelAssignee: Robert Scheck <redhat-bugzilla>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: redhat-bugzilla
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["3ab3bda0-4797-4148-829d-93e645aa8016"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2515830    

Description Thibault Guittet 2026-08-24 07:25:07 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy