Golang.org/x/mod vulnerabilities
We track 2 vulnerabilities in Golang.org/x/mod products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score
Latest Golang.org/x/mod vulnerabilities
- 8.4 High severity
cmd/go: Improper Verification of Cryptographic Signature
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to s
- 7.5 High severity
cmd/go: Improper Verification of Cryptographic Signature
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transp