Log in Start free

Vulnerability · Published Aug 13, 2026 · Assigned by Go

CVE-2026-56865Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

High 8.4

In plain English

A high-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.1%top 97.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24go1.26.8-r0ALPINE-CVE-2026-56865
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-56865
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-56865
Debian:14golang-1.261.26.6-1DEBIAN-CVE-2026-56865
Debian:14golang-1.271.27~rc3-1DEBIAN-CVE-2026-56865
Gogolang.org/x/mod0.40.0GO-2026-6179
Gotoolchain1.25.13, 1.26.6, 1.27.0-rc.3GO-2026-6179
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-56865
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.4USN-8935-1
Ubuntu:22.04:LTSgolang-1.221.22.2-2~22.04.4UBUNTU-CVE-2026-56865
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.5USN-8935-1
Ubuntu:24.04:LTSgolang-1.221.22.2-2ubuntu0.5UBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56865
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56865
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56865
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56865
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-56865
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56865
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56865
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-56865

Affected products (as reported)

VendorProductVersions
Go toolchain cmd/go 0 – before 1.25.131.26.0-0 – before 1.26.61.27.0-0 – before 1.27.0-rc.3
golang.org/x/mod golang.org/x/mod/sumdb/tlog 0 – before 0.40.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References