golang.org/x/mod/sumdb vulnerabilities

1 known vulnerability in golang.org/x/mod/sumdb from Golang.org/x/mod. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  cmd/go: Improper Verification of Cryptographic Signature

  CVE-2026-56864Aug 13, 2026Go toolchain

  A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transp