Fedora Account System
Red Hat Associate
Red Hat Customer
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Changed to IMPORTANT - 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N from CRITICAL - 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. CVSS Justification =================== * S:C -> S:U - The failure is in checksum/transparency-log verification inside the Go module client; impact is on module trust and build integrity in that same security authority, not a separate privilege boundary crossing (unlike e.g. sandbox escape). - Supply-chain harm is captured by I:H (malicious module content accepted); S:C mainly inflates the base score without adding a distinct impact the advisory describes. * A:H -> A:N - The advisory describes accepting malicious module content, not denial of service, crashes or resource exhaustion. - A malicious GOSUMDB does not need to make the service unavailable; the attack goal is integrity (and lookup metadata), not outage. - A:H on the prior vector was a major driver of Critical (9.6) with no support in GO-2026-6180 / Go issue #80745.