golang.org/x/mod/sumdb/tlog vulnerabilities

1 known vulnerability in golang.org/x/mod/sumdb/tlog from Golang.org/x/mod. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.4 High severity

  cmd/go: Improper Verification of Cryptographic Signature

  CVE-2026-56865Aug 13, 2026Go toolchain

  A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to s