Repository navigation
cmd/go, x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup #80745
Description
A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.
This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
This was a PRIVATE track issue, tracked in http://b/526586970.
Activity
thatnealpatel commentedon Aug 6, 2026
Hi @gopherbot, please open backport issues for this security issue.
gopherbot commentedon Aug 6, 2026
Backport issue(s) opened: #80766 (for 1.25), #80767 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/814801 mentions this issue:
[release-branch.go1.26] cmd/vendor: fix CVE-2026-56864 in x/mod[release-branch.go1.26] cmd/vendor: fix CVE-2026-56864 in x/mod
gopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/814821 mentions this issue:
[release-branch.go1.25] cmd/vendor: fix CVE-2026-56864 in x/modgopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/814861 mentions this issue:
[release-branch.go1.27] cmd/vendor: fix CVE-2026-56864 in x/mod[release-branch.go1.25] cmd/vendor: fix CVE-2026-56864 in x/mod
[release-branch.go1.27] cmd/vendor: fix CVE-2026-56864 in x/mod
gopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815000 mentions this issue:
sumdb: ignore unrelated hashes in Lookupgopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815020 mentions this issue:
all: update vendored x/modgopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815100 mentions this issue:
[internal-branch.go1.27-vendor] sumdb: ignore unrelated hashes in Lookup[-]security: fix CVE-2026-56864[/-][+]x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup[/+]gopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815082 mentions this issue:
[internal-branch.go1.26-vendor] sumdb: ignore unrelated hashes in Lookupgopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815120 mentions this issue:
[internal-branch.go1.25-vendor] sumdb: ignore unrelated hashes in Lookup[internal-branch.go1.25-vendor] sumdb: ignore unrelated hashes in Lookup
[internal-branch.go1.26-vendor] sumdb: ignore unrelated hashes in Lookup
[internal-branch.go1.27-vendor] sumdb: ignore unrelated hashes in Lookup
gopherbot commentedon Aug 13, 2026
Change https://go.dev/cl/815240 mentions this issue:
[release-branch.go1.27] cmd/internal/moddeps: restore testsall: update vendored x/mod
[release-branch.go1.27] cmd/internal/moddeps: restore tests
sumdb: ignore unrelated hashes in Lookup
[-]x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup[/-][+]cmd/go, x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup[/+]Bump golang.org/x/mod to v0.40.0 due to a high CVE golang/go#80745
Merge pull request #1363 from shivamerla/bump_go_mod_v0.40.0
Bring upstream v0.5.0 changes (#37)