Bug 2515836 (CVE-2026-56864) - CVE-2026-56864 golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB
Summary: CVE-2026-56864 golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypa...
Keywords:
Status: NEW
Alias: CVE-2026-56864
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-13 22:25 UTC by OSIDB Bzimport
Modified: 2026-09-10 08:13 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-13 22:25:09 UTC
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy

Comment 2 Yadnyawalk Tale 2026-09-10 07:47:16 UTC
Changed to IMPORTANT - 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N from CRITICAL - 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

CVSS Justification
===================
* S:C -> S:U
- The failure is in checksum/transparency-log verification inside the Go module client; impact is on module trust and build integrity in that same security authority, not a separate privilege boundary crossing (unlike e.g. sandbox escape).
- Supply-chain harm is captured by I:H (malicious module content accepted); S:C mainly inflates the base score without adding a distinct impact the advisory describes.

* A:H -> A:N
- The advisory describes accepting malicious module content, not denial of service, crashes or resource exhaustion.
- A malicious GOSUMDB does not need to make the service unavailable; the attack goal is integrity (and lookup metadata), not outage.
- A:H on the prior vector was a major driver of Critical (9.6) with no support in GO-2026-6180 / Go issue #80745.


Note You need to log in before you can comment on or make changes to this bug.