Log in Start free

Vulnerability · Published Aug 13, 2026 · Assigned by Go

CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

High 7.5

In plain English

A high-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24go1.26.8-r0ALPINE-CVE-2026-56864
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-56864
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-56864
Debian:14golang-1.261.26.6-1DEBIAN-CVE-2026-56864
Debian:14golang-1.271.27~rc3-1DEBIAN-CVE-2026-56864
Gogolang.org/x/mod0.40.0GO-2026-6180
Gotoolchain1.25.13, 1.26.6, 1.27.0-rc.3GO-2026-6180
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-56864
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-56864
Ubuntu:24.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56864
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56864
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56864
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56864
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56864
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56864
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56864
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56864

Affected products (as reported)

VendorProductVersions
Go toolchain cmd/go 0 – before 1.25.131.26.0-0 – before 1.26.61.27.0-0 – before 1.27.0-rc.3
golang.org/x/mod golang.org/x/mod/sumdb 0 – before 0.40.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References