CVE-2026-56864: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-09-03
Weakness: CWE-347

Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Affected products

Golang.Org/X/Mod: before 0.40.0 — fixed in 0.40.0
Go Toolchain: before 1.25.13; from 1.26.0-0 before 1.26.6; from 1.27.0-0 before 1.27.0-rc.3 — fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
Go: before 1.25.13; from 1.26.0-0 before 1.26.6; from 1.27.0-0 before 1.27.0-rc.3 — fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
golang.org/x/mod/sumdb: before 0.40.0 — fixed in 0.40.0

How to fix

Upgrade to a fixed version: Golang.Org/X/Mod 0.40.0; Go Toolchain 1.25.13, 1.26.6, 1.27.0-rc.3; Go 1.25.13, 1.26.6, 1.27.0-rc.3; golang.org/x/mod/sumdb 0.40.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56864 or the next vulnerability affects your stack